Repository navigation
Send the Jellyfin download token in the Authorization header - #1603
Merged
GianniCarlo merged 2 commits intoOct 5, 2026
Merged
GianniCarlo merged 2 commits into
GianniCarlo merged 2 commits into
Conversation
The download request put the access token only in an `?api_key=` query item. A Jellyfin 12.1.0 server rejects that with a 401, so downloads failed. The request now sets `Authorization: MediaBrowser Token="…"` after the custom headers, so a custom header cannot replace it. The `?api_key=` query item is removed, so the token does not go into the download task's persisted `taskDescription`. Refs TortugaPower#1598 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
pablofontanilla
marked this pull request as ready for review
September 24, 2026 14:34
createItemDownloadUrl no longer carries the token, so the URL alone gets a 401 on every Jellyfin version. Make it private with the same warning the AudiobookShelf builder has, so new callers go through createItemDownloadRequest, which adds the Authorization header. The client guard is gone: createUrlComponentsForApiRequest already throws noClient. The Sentry query-stripping comment no longer lists Jellyfin download URLs; AudiobookShelf's OIDC query still needs the stripping.
GianniCarlo
approved these changes
Oct 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Refs #1598. Jellyfin audiobook downloads fail with HTTP 401.
createItemDownloadRequestsent the access token only as an?api_key=query item. Our Jellyfin 12.1.0 server rejects that with a 401. This PR:Authorization: MediaBrowser Token="…"on the download request. It is set afterwrapWithCustomHeaders, so a custom header cannot replace it (same rule asJellyfinHeaderInjector).?api_key=query item. This also keeps the token out of the download task's persistedtaskDescription(SingleFileDownload-<url>).No new files and no
project.pbxprojchanges. The tests are in the existingJellyfinQuickConnectTests.swift.Header test on our 12.1.0 server
curl, same item, same API key:
/Items/{id}/Download(range)/Users/{uid}/Items/{id}?api_key=X-Emby-Token: <key>X-MediaBrowser-Token: <key>X-Emby-Authorization: MediaBrowser Token="<key>"Authorization: MediaBrowser Token="<key>"We did not check whether this is a 12.x default or a server setting.
Overlap with #1586
#1586 also fixes this download path, with
X-Emby-Tokenand no?api_key=. On our server,X-Emby-Tokenalso gets a 401 (see the table), so #1586 may need theAuthorizationheader too.@GianniCarlo, you can pick the merge order. If this PR merges first, keep your version of
createItemDownloadRequestwhen you rebase and change the header. If you prefer, I can rebase this PR onto #1586.Out of scope
#1598 also says that Quick Connect does not work. This PR does not change Quick Connect.
Tests
JellyfinDownloadRequestTests(2 tests): the token is in theAuthorizationheader, and the URL has no token and noapi_key.Unit Testsplan (BookPlayerTests), iPhone 17 simulator: 535/535 pass.?api_key=returned 401 with curl.)🤖 Generated with Claude Code