starred/jellyfin

Fork 0

mirror of https://github.com/jellyfin/jellyfin.git synced 2026-01-23 23:20:51 +01:00

[security] support replay protection for TLS 0-RTT #4597

New issue

Open

opened 2025-12-22 00:20:34 +01:00 by backuprepo · 3 comments

backuprepo commented

2025-12-22 00:20:34 +01:00

Owner

Originally created by @ghost on GitHub (Feb 3, 2023).

TLS 0-RTT is a standard that allows applications to connect to servers with https faster by reducing the amount of handshakes needed by 1. Unfortunately, it's vulnerable to replay attacks

As per RFC, a reverse proxy will send an "Early-Data" header to a downstream server if it received a request using 0-rtt. The server must decide if the request is vulnerable to a replay attack and if it is, reject the request and reply with status 425 (http too early)

This is important because 0-rtt currently seems to be mandatory with http/3 implementations and that doesn't seem like it's going to change so jellyfin has to implement replay attack protection at its end using this header

Originally created by @ghost on GitHub (Feb 3, 2023).  TLS 0-RTT is a standard that allows applications to connect to servers with https faster by reducing the amount of handshakes needed by 1. Unfortunately, it's vulnerable to replay attacks As per RFC, a reverse proxy will send an "Early-Data" header to a downstream server if it received a request using 0-rtt. The server must decide if the request is vulnerable to a replay attack and if it is, reject the request and reply with status 425 (http too early) This is important because 0-rtt currently seems to be mandatory with http/3 implementations and that doesn't seem like it's going to change so jellyfin has to implement replay attack protection at its end using this header

backuprepo added the

security

bug

enhancement

labels 2025-12-22 00:20:34 +01:00

backuprepo commented

2025-12-22 00:20:38 +01:00

Author

Owner

@lucasmz-dev commented on GitHub (Jul 9, 2023):

I want to maybe enable 0 RTT on Caddy, I see you the commits merged but they seem to be for jellyfin.org, I'm confused whether this is still an issue or not, I would like some clarification please?

@lucasmz-dev commented on GitHub (Jul 9, 2023): I want to maybe enable 0 RTT on Caddy, I see you the commits merged but they seem to be for jellyfin.org, I'm confused whether this is still an issue or not, I would like some clarification please?

backuprepo commented

2025-12-22 00:20:41 +01:00

Author

Owner

@felix920506 commented on GitHub (Mar 3, 2024):

Is this still an issue on the server?

@felix920506 commented on GitHub (Mar 3, 2024): Is this still an issue on the server?

backuprepo commented

2025-12-22 00:20:43 +01:00

Author

Owner

@AkechiShiro commented on GitHub (Jun 1, 2024):

Any news ?? @randomhydrosol

If there is no response @felix920506 I'll try and check the code of Jellyfin's server and see if the header is checked or not currently.

@AkechiShiro commented on GitHub (Jun 1, 2024): Any news ?? @randomhydrosol If there is no response @felix920506 I'll try and check the code of Jellyfin's server and see if the header is checked or not currently.

backuprepo referenced this issue

2025-12-22 07:47:47 +01:00

[PR #4597] [MERGED] Add NEO OpenCL runtime for Intel Tone mapping #10003

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: starred/jellyfin#4597

No description provided.

Rows
Columns