Skip to content

v1.4.0 — Passkeys + safety net

Choose a tag to compare

View all tags
@ZL154 ZL154 released this 18 Apr 03:24
v1.4.0
d3807ca

Major release

Adds passkeys (Face ID / Touch ID / Windows Hello / YubiKey via WebAuthn), self-service emergency lockout, TOTP rotation, recovery PDF, admin diagnostics + adoption dashboard, bulk admin actions, webhook with HMAC + Discord/Slack auto-reshape, suspicious-login alerts, audit hash chain, per-user concurrent-session cap, and 13 in-flight security audit fixes.

Full changelog in README.

Highlights

  • Passkeys — sign in with one biometric tap from any browser. Works on iPhone (Safari + iCloud Keychain), Android (Chrome + Google Password Manager), desktop (any FIDO2 platform / hardware key). Native apps continue using device pairing.
  • Emergency lockout — one-click "I lost my phone" wipes everything and forces recovery on next sign-in.
  • Webhook events — Discord, Slack, or any HTTPS endpoint. HMAC-signed, SSRF-guarded.
  • Audit hash chain — silent tampering with the audit log is now detectable.
  • Per-user GDPR export, bulk actions, force-logout per user, expandable lists, dashboard sidebar entry — admin tab is fully fleshed out.

Install

Add the manifest to Jellyfin: https://raw.githubusercontent.com/ZL154/JellyfinSecurity/main/manifest.json

Important config for passkeys

After install, Dashboard → Plugins → Two-Factor Authentication → Settings → WebAuthn:

  • Relying Party ID — your public hostname (e.g. jellyfin.example.com, no scheme/port)
  • Allowed origins — full URLs users will sign in from (https://jellyfin.example.com, https://jellyfin.example.com:8096, etc)

If you skip this, browsers will refuse passkeys.

Bundled deps

  • Fido2NetLib (MIT)
  • MaxMind.Db (Apache 2.0)
  • QuestPDF (Community license, free under USD 1M revenue)
  • Linux x64 native libs included (libsodium, libQuestPdfSkia). Windows / macOS users need Docker or manual native install.
Assets 3
Loading