can modify response headers?

[justinrh 287]

I was looking at my Caddy reverse proxy logs and see Emby is handing out a large amount of response headers.  If I'm misunderstand the logging, please tell me.

My main question is, are all of these methods necessary for media playback and picture upload? :

"Access-Control-Allow-Methods": [
            "GET, POST, PUT, DELETE, PATCH, OPTIONS"
        ]

Can I remove some of those methods?

What I really don't like about this is that all of this stuff is handed out even for 404's, like when the public is scanning and fishing for services! 

 

the whole thing:

"resp_headers": {
        "Via": [
            "1.1 Caddy"
        ],
        "Strict-Transport-Security": [
            "max-age=31536000"
        ],
        "Content-Type": [
            "text/plain"
        ],
        "Access-Control-Allow-Methods": [
            "GET, POST, PUT, DELETE, PATCH, OPTIONS"
        ],
        "Cross-Origin-Resource-Policy": [
            "cross-origin"
        ],
        "Private-Network-Access-Name": [
            "server name that emby doesn't like"
        ],
        "Server": [
            "UPnP/1.0 DLNADOC/1.50"
        ],
        "Content-Length": [
            "39"
        ],
        "Access-Control-Allow-Origin": [
            "*"
        ],
        "Date": [
            "Mon, 31 Aug 2026 14:01:56 GMT"
        ],
        "Access-Control-Allow-Headers": [
            "Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, Slug, Transfer-Encoding, Want-Digest, X-MediaBrowser-Token, X-Emby-Token, X-Emby-Client, X-Emby-Client-Version, X-Emby-Device-Id, X-Emby-Device-Name, X-Emby-Authorization"
        ],
        "Access-Control-Allow-Private-Network": [
            "true"
        ],
        "Private-Network-Access-Id": [
            "8yuizxfe9a604c159a4dbd55fad7bjku"
        ]
    }

 

Edited 22 hours ago by justinrh

[Luke 42998]

Hi, we don't actually just put or patch, but the rest are needed.

[justinrh 287]

Can you or I not respond with all that stuff for 404's?

[Luke 42998]

Possibly but I'm not sure. That will require some evaluation.

[rdhardi 45]

I realize this post is marked as solved, but I just had to comment because it was such a coincidence to me. Off topic from the OP's post, but when I checked my Caddy reverse proxy logs this morning, I saw mostly 404s as expected...except for a couple of 200s from unknown ips on openapi.json and swagger.json files. Not sure what that means, but I disabled remote access while I investigate (sorry hubby! ). If I can't figure it out, I'll create a new post.

Edited 18 hours ago by rdhardi

[justinrh 287]

From what I could tell, the 404's were from scanners trying to look for known resources or figure out what kind of service I'm hosting.

[rdhardi 45]

Yeah, I'm not worried about the 404s. It's the 200s on the openapi.json and swagger.json files. 200 indicates request succeeded, so if I understand correctly, they were able to read the .json files. Idk, still have remote access disabled until I have time to check it out and I'll create a new post. Here's what it looks like in my caddy reverse proxy log:

2026-09-01 | 00:09:47 | 35.231.117.184  | 200 | GET    | 2114ms | myserver.com/openapi.json
2026-09-01 | 00:09:47 | 35.231.117.184  | 200 | GET    | 1697ms | myserver.com/swagger.json