Images in the media library cannot be viewed, and neither images nor videos can be downloaded.

[taffy1883null]

Title

[Help] Media downloads fail (prompts to log in via a .txt file) and original images won't load, but video streaming works fine.

Body

Hi everyone! Following the community guidelines, I am opening a discussion here to seek help from the community and volunteers before treating this as a bug. I've been struggling with a very weird network/authentication issue on my local Jellyfin deployment.

Server Environment:

• OS: Windows (Local deployment, not Docker)
• Clients tested: Chrome (Web) and the official Android App.
• Storage: Media and Cache are stored in custom paths（C:\ProgramData\Jellyfin\）.

The Symptoms:

1. Streaming works perfectly: I can play any video smoothly, which means the media paths are valid and chunked streaming is fine.
2. Images won't fully load: Thumbnails load fine (after I moved the cache folder to a pure-English path), but clicking to view the original poster/image fails to load.
3. Downloads fail bizarrely: When I click the "Download" button for a video or a .png image, it fails. Instead of the media file, my browser attempts to download a file named Download.txt (or similar). The download manager displays an error like: "Please log into the corresponding website first before trying to download."

My Assessment:
It seems that when a full file request (download) is initiated, the Authentication Token (or Cookie) is somehow being stripped or lost. The Jellyfin server sees an unauthorized request and returns an error text (like 401 Unauthorized), which the browser then misinterprets as a .txt file download.

Troubleshooting Steps I've Already Taken:
To save everyone's time, here is what I have already ruled out:

• User Permissions: "Allow media downloads" is strictly checked in the Dashboard.
• Network & Proxies: I have completely shut down Clash Meta (and all transparent proxies), verified that the Windows system proxy is disabled, and left the "LAN networks" field in Jellyfin empty.
• Download Managers: I have disabled IDM (Internet Download Manager) and all related browser extensions.
• Cache Bug (Resized-image cache written non-atomically → 0-byte entries served permanently (blank posters/thumbnails) #17135): I checked my cache/images/resized-images/ folder, and there are no 0-byte files, so this is not the concurrent I/O bug.

Has anyone encountered this "pseudo-unauthorized" download interception before? Are there specific logs I should check or network settings (like CORS or local HTTP policies) I might have missed?

Any guidance would be greatly appreciated! Thank you for your time.

[taffy1883null]

Hi again! I want to give a huge thank you for your help. Your guidance was the exact breakthrough I needed!

I followed your advice and checked the DevTools, and you were 100% right—it was a 401 Unauthorized error. However, as I was going through the logs step by step, I discovered something crazy: the timestamps on the generated tokens weren't matching up. I highly suspect it was an issue with my Windows local time synchronization being slightly off, causing the server to instantly reject the newly issued tokens as "expired."

On top of that, since I was using the Portable version from the official website, I suspected its local database (auth.db) or permission structure might have gotten corrupted when I messed with the cache paths earlier.

To solve this once and for all, I decided to take the nuclear option: I cloned the jellyfin and jellyfin-web repositories and compiled both the backend and frontend from source myself!

And... it worked beautifully! Running the freshly compiled pure build, the token generation works perfectly, and media downloads are finally functioning flawlessly without any .txt interception.

Thank you again for pointing me in the exact right direction and taking the time to help me troubleshoot. You are a lifesaver, and you definitely earned that Galaxy Brain badge! 🥰