Potential unauthorized access to content at endpoint: /audio/{item id}/stream

[nxenos83 52]

It looks like this end point allows transmission of audio content without any authorization.

 

I confirmed on a device that was not part of the LAN and was not authenticated. 

 

Sever Version 3.2.1.0

[Luke 42086]

Thanks for the report, we'll take a look.

[nxenos83 52]

Thanks Luke.

Because of this opening, it was much easier getting an echo to play music hosted on my emby server

[Luke 42086]

Well it won't be for long. Several months ago I let all of the relevant parties know that we'd be closing this api in the future, and I think after the next release it will probably be a good time to do that.

[nxenos83 52]

I wonder if there are other cases when an exposed un-authenticated endpoint is needed to stream.

 

Maybe instead of passing the static item id, there could be some sort of leasing model. A token could be created for a particular item by an authenticated users for a specified time. Write that token, the item id, and expiration time to db (or in memory). Then the token can be passed in the url instead of the item id. The end point then queries the db for the token. If token is still valid, continue processing for the item id associated with the token.

 

Not sure how much the need is for something like this, or maybe there is an approach that already exists.  Is the endpoint be decommissioned for a reason besides lack of authentication?

Edited February 21, 2017 by nxenos83