when reading through the jellyfin with chromecast guide i realized that it would probably be less effort to just let the casting api be public, with the added bonus that i could then cast my library to any device that supports it. but that seems like it would paint a giant target on the server.

what’s the recommended way of doing stuff like this? ideally i want to be able to go to someone’s house and just play some of my media on their tv.

not that any of this is doable in the near future, since i’m behind cgnat and won’t get my colocated bounce server up until spring.

  • fightforlife@lemmy.worldEnglish
    1·
    1 day ago

    An Idea I am also using for other things where I do not want to use a VPN:

    1. Setup a reverse proxy (e.g. traefik)
    2. Setup an oauth middleware for everything (forward Auth)
    3. Create rules to exempt very specific request based on IP, headers, etc… from the middleware.

    In the casting use case you have to find a request and check if there is any parameter that you can use to safely whitelist the request. Ofcourse someone could get behind this and fake the request to match the whitelist. But without knowing that there is even a whitelist no one will really try