Cannot login outside of local network

[ytzelf 2]

Hello everyone,

 

I have this weird bug where I can't login to my emby server from my cellphone / tablet if I'm outside of my home network; login fails with "Request was denied for security." message (cf screenshot below).

Emby website in my browser outside of home network works fine.

 

I am running Emby behind a nginx reverse proxy so I don't connect through emby connect but through an URL like xxx.noip.me:123/emby

App stopped working a few weeks back with no change on the server configurations.

 

 

Edited August 18, 2016 by ytzelf

[Luke 40067]

Hi, welcome. Can you provide an app log?

 

http://emby.media/community/index.php?/topic/15638-how-to-report-an-android-problem/

 

Thanks.

[pir8radio 1305]

You may want to post your nginx config as well... Even though it's likely fine. 

[ytzelf 2]

Attached is a log of the mobile app.

Nginx config for emby/ location is below.

 

Had a look at the mobile app logs and there seem to be error related to my subscriber status.. I am however a premium user

 

Might also be of interest that i'm using CM13 latest nightlies on my Oneplus X.

 

 location /emby {
                access_log              /var/log/nginx/emby_access.log;
                error_log               /var/log/nginx/emby_error.log;
                proxy_set_header        Host $host;
                proxy_set_header        X-Forwarded-Proto $remote_addr;
                proxy_set_header        X-Forwarded-Protocol $scheme;
                proxy_set_header        X-Real-IP $remote_addr;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header        Upgrade $http_upgrade;
                proxy_set_header        Connection "upgrade";
                proxy_http_version      1.1;
                proxy_redirect          off;
                proxy_pass              http://127.0.0.1:8096;
}

970a3289-1d1d-42d2-8db4-6f1d1bfc184d.log

Edited August 22, 2016 by ytzelf

[Luke 40067]

Having premiere or not won't affect your ability to login.

[ACB 5]

I'm getting the same error (as posted in http://emby.media/community/index.php?/topic/37782-request-was-denied-for-security-error/), yet I'm not using a reverse proxy and am using Emby Connect.

This is only when I'm outside my network and was working a month or two ago, both on a wifi network and on 4g/LTE.

I can connect if I use a web browser on my mobile device (ie chrome), so I know the remote capability is working. Seems to be only the android app. Possibly changes in the security settings?

[pir8radio 1305]

How are you guys connecting? directly to the server or using emby connect? 

[ACB 5]

By default I use Emby Connect, but I've tried direct as well entering manual server details.

I've just tried turning off https by unchecking "Report https as external address", and it works!

So is a self-signed certificate issue?

Edited August 22, 2016 by ACB

[pir8radio 1305]

So your issue was trying to run SSL using the Android APP?   Disabled SSL and it works.   Lets see what the OP comes back with and find a pattern...

[Luke 40067]

what version of android is it?

[ACB 5]

Mine is Android version 5.1 (other version details are in the other thread, although Emby is now up to the latest beta versions)

[Luke 40067]

Are you able to install apps from the play store? try installing the android system webview app.

[ACB 5]

Yes, I can install from the play store. I've installed the android system webview app, and re-ran Emby and now get a black screen? I'll reboot my phone and try again.

Just rebooted, and still getting a black/blank screen when I run emby now. :-(

Edited August 23, 2016 by ACB

[Luke 40067]

Please provide an app log. thanks.

[ACB 5]

Find attached my log file. Hope this helps.

00dfc899-5136-495d-bdb3-68e77560fc46.log

[Luke 40067]

Oddly enough it still can't find the webview app so i guess i would just remove it. It's probably not worth looking into whatever variables your modded OS is throwing at it.

[ACB 5]

Oops... I uploaded the wrong file. (I couldn't see the time in the view I was using in ES File Explorer).

This one is correct.

79c53974-b204-4732-a1b8-de3fc1222b6b.log

[ytzelf 2]

I'm connecting directly (no emby connect).

My OS is CyanogenMod 13 based on Android 6.0.1 but I doubt it's relevant since I get the same error on my gf Shield which is stock OS.

 

I installed the android webview app and now I don't get the popup "Request denied...". The colored circle keeps spinning and I'm brought back to the welcome screen ("Next"... and then "Skip", connect manually etc.)

 

New log attached, thanks everyone for the assistance!

ef53e1e3-6934-4615-a187-7e0d59fb6ded.log

[anderbytes 140]

To all that still can't connect:

 

- If you are trying with HTTP (port 8096), have you followed https://github.com/MediaBrowser/Wiki/wiki/Connectivity tips ?

- If you are trying with HTTPS (port 8920), are you using self-signed cert or custom one? Is it a full chain pfx? Is the pfx imported into client device? Is your issuer trusted?

 

 

Luke, I believe https://github.com/MediaBrowser/Wiki/wiki/Connectivity has to be updated for the particularities of HTTPS 8920 (those quoted above)

[anderbytes 140]

Googling a bit... strangely I found this:

- https://github.com/crosswalk-project/crosswalk/blob/master/runtime/android/core_internal/strings/android_xwalk_strings.grd

- https://crosswalk-project.org/

 

Exactly same message in there, also SSL related, Webview related...

 

Any of you know what is this?

[ytzelf 2]

Well I'm not using https in my local network but I am using https for connecting to nginx which then proxy_pass to localhost:8096.

Using a self-signed certificate.

 

Again, it was all working fine until a few month back (can't pinpoint the exact update).

[anderbytes 140]

Well I'm not using https in my local network but I am using https for connecting to nginx which then proxy_pass to localhost:8096.

Using a self-signed certificate.

 

Again, it was all working fine until a few month back (can't pinpoint the exact update).

 

Hmm... that's an unusual setup... I guess.

Do you have knowledge of how the http headers are passed via the reverse proxy? If they are wrong... you may be confusing Emby Server or even Emby Mobile

[ytzelf 2]

Hmm... that's an unusual setup... I guess.

Do you have knowledge of how the http headers are passed via the reverse proxy? If they are wrong... you may be confusing Emby Server or even Emby Mobile

 

 Unusual if running just emby on the machine but since I'm running a whole bunch of other services it does provide a single access point with nice URLs.

 

I am not knowledgeable on the innards of http headers in nginx; but my configuration and which headers I am modifiying with the reverse proxy is there

 location /emby {
                access_log              /var/log/nginx/emby_access.log;
                error_log               /var/log/nginx/emby_error.log;
                proxy_set_header        Host $host;
                proxy_set_header        X-Forwarded-Proto $remote_addr;
                proxy_set_header        X-Forwarded-Protocol $scheme;
                proxy_set_header        X-Real-IP $remote_addr;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header        Upgrade $http_upgrade;
                proxy_set_header        Connection "upgrade";
                proxy_http_version      1.1;
                proxy_redirect          off;
                proxy_pass              http://127.0.0.1:8096;
}

[anderbytes 140]

I don't see anything out of the expected... but I'm not an expert in these headers, too.

[pir8radio 1305]

I have the same setup (nginx SSL - Emby no ssl)  but no android to test. Give it a try on my server and report your findings. If it works then we can start looking into your nginx setup.
 

Edited January 26, 2017 by pir8radio