Security

Keep the admin site private

The admin site is not gated by default. Anyone who can reach it can try to sign in with a Jellyfin administrator's name and password, and the admin API answers anyone holding ADMIN_TOKEN. JellyPass limits sign-in attempts, but:

• give the admin site a name of its own, not a household address or Seerr's;
• keep it on your LAN, or put it behind an identity-aware gate, a VPN or an IP allowlist at your proxy (see the proxy examples);
• in 3.x, forward only household names to JellyPass from the internet: any other name reaching it is answered as the admin site.

Tokens and keys

• Use different long random values for WEBHOOK_TOKEN and ADMIN_TOKEN. If ADMIN_TOKEN is unset, the webhook token also unlocks the admin API.
• Keep Jellyfin, Seerr and TMDB keys out of Git, screenshots and support requests. JellyPass never logs passwords, Jellyfin tokens, the Jellyfin API key or webhook tokens.
• Send the webhook token in the Authorization header. ?token= can appear in logs and is deprecated: 3.x still accepts it, 4.0.0 will not.

The state file

It holds grants, households, Jellyfin user IDs and a catalogue of media names. JellyPass creates it readable by its owner only; keep backups just as private.

Behind the proxy

• Serve household and admin traffic over HTTPS, and don't publish JellyPass's port directly to untrusted networks.
• Set TRUSTED_PROXIES to your proxies only.
• Keep a separate way to reach Jellyfin as an administrator that doesn't go through a household address.

Administrator sessions

The admin site signs in with Jellyfin: the password goes to Jellyfin, the temporary Jellyfin session is closed at once, and JellyPass keeps its own session in memory for 12 hours. Every five minutes it checks the administrator is still an enabled Jellyfin administrator. Restarting JellyPass signs everyone out.

Reporting a vulnerability

Please report security problems privately through GitHub security advisories, not in a public issue. Fixes go to the latest release line; pin a version and read release notes before upgrading.

Edit this page on GitHub