No SSL Security when accessing through app.emby.media

[quackpipe 11]

Good morning!

I have my server setup to only accept secure SSL external connections. If I connect directly through my personal URL, the SSL security tag/logo is in the corner of my chrome browser. If I connect through app.emby.media it doesn't have an SSL logo (pad lock) in the address bar.

Is the connection still secure when visiting through app.emby.media? 

Thanks 

[Garbonzo17 26]

Well I "thought" I was going to say that if it works correctly through your domain it should also appear that way through emby connect...

however I just did the same thing (I hadn't use app.emby.media in quite some time) and it still shows and "open lock" not secure.

It works though, and my server doesn't allow not ssl encrypted traffic. It is forced by NGINX.  So I am inclined to believe it is talking about the connection to app.emby.media, and I am not sure of the implications of that... In my head, I thought the app.emby.media was just forwarding things, but I must have that wrong...

But it would seem that traffic between my server and emby.media would be encrypted because that is the only way to access my server, and traffic to and from whatever client is connected to app.emby.media would be in the clear.

I am not even using emby connect for any of my users, but all of the sudden this topic is of interest to me... I need to figure out what is going on too. Just in case

I'll let you know if I find out anything but I am pressed for time this afternoon...

-G

Edited December 6, 2021 by Garbonzo17

[Luke 42085]

If you have SSL on your server, then use the https version of our online web app, https://app.emby.media

[Garbonzo17 26]

Wow, that was dead simple, and an over-site on my part I guess...

I guess I was right in part that emby was making the connection secured to my box, and traffic from me to app.emby.media was unencrypted.

what confused me was the unlock/non-ssl working at all.. That seems like it shouldn't happen... it's not possible to connect to my server via domain/ip without SSL, its forced.

Non of my family use the app.emby.media method anyway, so its not an issue per se, but good to know I suppose.

[Luke 42085]

Yes, when we can find a way to ensure SSL for all Emby servers out of the box, then we'll deprecate the http version of app.emby.media.

[Garbonzo17 26]

Yep, my dumbass just had to look this up again.. I just figured it would try the https and fail down if it didn't work, but I am not sure that's how things function.

Anyway, it just alway throws me because I can't access my server without https... so when it shows that way in connect I think "whats going on?" but then I realize it is just the connection from app.emby.media to me that is not using SSL, but whay I don't know is what effect that has on the actual traffic from my server. In settings I still allows 8096 non ssl on LAN, but not WAN...  So it is confusing me on the actual traffic.

Thanks again

-G