Description
Both Plex and Jellyfin API tokens are passed as URL query parameters rather than HTTP headers.
Locations
- Plex:
internal/streams/streams.go — X-Plex-Token in query string
- Jellyfin:
internal/streams/streams.go — api_key in query string
Impact
URL query parameters are more likely to leak through:
- Proxy/load balancer access logs
- Server access logs
- Browser history (if proxied)
ps output on shared systems
Fix
- Jellyfin supports header-based auth via
X-API-Key or Authorization: Bearer headers
- Plex
/status/sessions endpoint requires token in query string, but this should be documented as a known limitation
Priority
Medium — low likelihood of exposure in typical homelab setups, but good security hygiene.
Description
Both Plex and Jellyfin API tokens are passed as URL query parameters rather than HTTP headers.
Locations
internal/streams/streams.go—X-Plex-Tokenin query stringinternal/streams/streams.go—api_keyin query stringImpact
URL query parameters are more likely to leak through:
psoutput on shared systemsFix
X-API-KeyorAuthorization: Bearerheaders/status/sessionsendpoint requires token in query string, but this should be documented as a known limitationPriority
Medium — low likelihood of exposure in typical homelab setups, but good security hygiene.