Remote User Access - Access Token is invalid or expired

[Lessaj 467]

No I'm using httpd, but I imagine you could modify it to fit Nginx syntax.

Quote

Header always set Content-Security-Policy "default-src 'self' *.gstatic.com mediabrowser.github.io mb3admin.com; style-src 'self' 'unsafe-inline'; media-src 'self' blob: 'self'; worker-src 'self' blob: 'self'; script-src 'self' *.gstatic.com; img-src 'self' *.thetvdb.com *.tmdb.org github.com raw.githubusercontent.com mediabrowser.github.io"

 

Edited February 26, 2025 by Lessaj

[Neminem 1518]

Will try when I get the time, need to travle for work then coming week.

[Nvitalian 8]

I appreciate everyone's help. I think the root cause is this is running as a Truenas "App" versus me building out the container myself. No big deal at this point. If external users use Emby Connect, they are able to come into the server without the token issue.

Thanks again.

[sukerbole1 2]

I ran into this exact same issue. My setup is the following:

• NGINX Proxy Manager in docker
• Emby in docker
• *.domain.com setup for SSL
• emby.domain.com added as proxy host to the localip:port
   

Website is all good. Android apps did not work. Adding the location from earlier in the thread fixed it.

 

 

[Neminem 1518]

@sukerbole1Just got back to this again

So my custom location now look like this, love it Thanks @Lessaj

add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer" always;
add_header X-Download-Options "noopen" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "none" always;
add_header X-Permitted-Cross-Domain-Policies "master-only" always;
add_header Pragma "no-cache" always;
add_header Cache-Control "no-store" always;
add_header Content-Security-Policy "default-src 'none'; child-src 'self'; font-src 'self' data:; connect-src 'self' wss: ws: https://mb3admin.com https://github.com/MediaBrowser/; media-src 'self' blob: data: https://github.com/MediaBrowser/; manifest-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'self'; object-src 'self'; worker-src 'self' blob:; script-src 'self' https://sub.YOUR-Domain.com. https://www.gstatic.com; img-src data: https: http:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/css; report-to https://magicc.report-uri.com/r/d/csp/reportOnly;" always;

 

Edited May 29, 2025 by Neminem