Question - Authentication

[PenkethBoy 2063]

Most of Emby's endpoints require authentication to work.

 

However if i create a link in a web page to connect to say a Movie detail screen this appears to work without any access token being supplied

 

e.g - within my LAN

 

".../web/index.html#!/itemdetails.html?id=3b3b2163749d4ac7772ffe666418100f&serverId=393d783c30484015a24645f7844060b4"

 

It brings up the web page with no authentication i can see - unless its using the browser cache for the details or something else or not?

 

However if i use a different browser which has not connected to emby server before - you get a blank screen and Emby changes the link to 

 

".../web/index.html#!/login.html?serverid=393d783c30484015a24645f7844060b4"

 

and does nothing.

 

So just trying to understand when i need to provide an access token and not (assuming the details are cached etc)

 

[edit]

 

If i tag the api_key on the end of the url - it still works but the api_key is not stripped from the url - so should it be?

Edited June 28, 2018 by PenkethBoy

[Luke 37116]

It's using the saved credentials if you're already logged in. Putting the apikey onto the query string will work for individual api urls, but not for web app pages.

 

So basically that browser will need to be logged in already. Thanks.

[PenkethBoy 2063]

Ok thats a little clearer

 

1. whats the timeout on the cached credentials?

 

2. what do you mean by web app pages? 

[Luke 37116]

There isn't a time out. It's until either you sign out or clear browsing data.

 

By pages I just mean to say that you can't put the apikey onto the query string for.HTML urls.

[PenkethBoy 2063]

Ok thanks