Jellyfin Roku triggering Crowdsec http-probing ban -- trying to get images that don't exist?

ConfusedOwlet commented 3 months ago

Software Versions

Jellyfin Server Version: 10.9.9
Roku Client Version: ? Forgot to check, but assuming the newest available on the Roku Store (not beta).

Describe the bug

Pretty much exactly the same as this issue over on Swiftfin: https://github.com/jellyfin/Swiftfin/issues/690 https://github.com/jellyfin/Swiftfin/issues/884

Accessing Jellyfin through the Roku app triggers http-probing bans within Crowdsec. Running Jellyfin in any other client (Android, AndroidTV, Chrome/Firefox, etc) all work normally without causing the http-probing ban.

Looking at Crowdsec and nginx logs show that it's due to Roku constantly trying to find some images that then result in 404 not found. Mostly happens when browsing through sections/trying to generate thumbnails. Once you actually start streaming/watching things, you're usually good.

How To Reproduce

1.Browse Jellyfin on Roku app by going through Series, Collections, Seasons, etc.

After a couple minutes of browsing, Crowdsec will freak out and ban the IP until you manually unban it.

Expected behavior

Be able to browse through Jellyfin without being banned by Crowdsec?

Logs

NGINX logs on what's not being found

xxx.xxx.xxx - - [24/Aug/2024:22:32:18 +0000] "GET /Items/9748abb9d039731eec9970360f1b46e1/Images/Primary?maxHeight=384&maxWidth=196&quality=90 HTTP/2.0" 200 7152 "-" "Roku/DVP-13.1 (13.1.4.01510-30)"
xxx.xxx.xxx - - [24/Aug/2024:22:32:18 +0000] "GET /videos/9748abb9d039731eec9970360f1b46e1/additionalparts HTTP/2.0" 200 48 "-" "Roku/DVP-13.1 (13.1.4.1510-30)"
xxx.xxx.xxx - - [24/Aug/2024:22:32:18 +0000] "GET /Items/6146fb1be926c330c031bb2e40c6b45a/Images/Primary?maxHeight=384&maxWidth=196&quality=90 HTTP/2.0" 200 20925 "-" "Roku/DVP-13.1 (13.1.4.01510-30)"
xxx.xxx.xxx - - [24/Aug/2024:22:32:18 +0000] "GET /Items/e41ffbad81de506d286d6744aaba6694/Images/Primary?MaxHeight=330&MaxWidth=234&quality=90&Tags=null HTTP/2.0" 404 52 "-" "Roku/DVP-13.1 (13.1.4.01510-30)"
xxx.xxx.xxx - - [24/Aug/2024:22:32:18 +0000] "GET /Items/86ef0c6c40bd2cc559d18c2938881ce8/Images/Primary?MaxHeight=330&MaxWidth=234&quality=90&Tags=null HTTP/2.0" 404 58 "-" "Roku/DVP-13.1 (13.1.4.01510-30)"
xxx.xxx.xxx - - [24/Aug/2024:22:32:18 +0000] "GET /Items/0e04e09b17e7d79e47d926d16331d34d/Images/Primary?MaxHeight=330&MaxWidth=234&quality=90&Tags=null HTTP/2.0" 404 51 "-" "Roku/DVP-13.1 (13.1.4.01510-30)"
xxx.xxx.xxx - - [24/Aug/2024:22:32:18 +0000] "GET /Items/0f32532cb1e51a12a170288553871a9f/Images/Primary?MaxHeight=330&MaxWidth=234&quality=90&Tags=null HTTP/2.0" 404 55 "-" "Roku/DVP-13.1 (13.1.4.01510-30)"
xxx.xxx.xxx - - [24/Aug/2024:22:32:18 +0000] "GET /Items/ea4b0e2bdb7c4874122a3360cbc21676/Images/Primary?MaxHeight=330&MaxWidth=234&quality=90&Tags=null HTTP/2.0" 404 56 "-" "Roku/DVP-13.1 (13.1.4.01510-30)"
xxx.xxx.xxx - - [24/Aug/2024:22:32:18 +0000] "GET /Items/712d3146de90979ae263c0e5a7adad5a/Images/Primary?MaxHeight=330&MaxWidth=234&quality=90&Tags=null HTTP/2.0" 404 54 "-" "Roku/DVP-13.1 (13.1.4.01510-30)"
xxx.xxx.xxx - - [24/Aug/2024:22:32:18 +0000] "GET /Items/d553b6c0930dc065b0e7ff8c4d7f0c38/Images/Primary?MaxHeight=330&MaxWidth=234&quality=90&Tags=null HTTP/2.0" 404 54 "-" "Roku/DVP-13.1 (13.1.4.01510-30)"
xxx.xxx.xxx - - [24/Aug/2024:22:32:18 +0000] "GET /Items/c797bf5e30017bc9d1bb9303f890c3a1/Images/Primary?MaxHeight=330&MaxWidth=234&quality=90&Tags=null HTTP/2.0" 404 57 "-" "Roku/DVP-13.1 (13.1.4.01510-30)"
xxx.xxx.xxx - - [24/Aug/2024:22:32:18 +0000] "GET /Items/bfb2b43c2dd0f681c825211909b23aab/Images/Primary?MaxHeight=330&MaxWidth=234&quality=90&Tags=5b0e6a27ff0fd557d614680f2fca7519 HTTP/2.0" 200 22163 "-" "Roku/DVP-13.1 (13.1.4.01510-30)"
xxx.xxx.xxx - - [24/Aug/2024:22:32:18 +0000] "GET /Items/fa451226baa1a216dd6f5a26ba88973d/Images/Primary?MaxHeight=330&MaxWidth=234&quality=90&Tags=null HTTP/2.0" 404 57 "-" "Roku/DVP-13.1 (13.1.4.01510-30)"
xxx.xxx.xxx - - [24/Aug/2024:22:32:18 +0000] "GET /Items/9748abb9d039731eec9970360f1b46e1/Similar?limit=16&userId=777753c236ad474886eac892a7a6b8a1 HTTP/2.0" 200 20649 "-" "Roku/DVP-13.1 (13.1.4.1510-30)"
xxx.xxx.xxx - - [24/Aug/2024:22:32:18 +0000] "GET /Items/fc305480cbe78d893821f9b0a579fe27/Images/Primary?MaxHeight=330&MaxWidth=234&quality=90&Tags=null HTTP/2.0" 404 57 "-" "Roku/DVP-13.1 (13.1.4.01510-30)"
xxx.xxx.xxx - - [24/Aug/2024:22:32:18 +0000] "GET /Items/b72ba4c9fbd467f1bc2a63438f2d888f/Images/Primary?MaxHeight=330&MaxWidth=234&quality=90&Tags=null HTTP/2.0" 404 54 "-" "Roku/DVP-13.1 (13.1.4.01510-30)"
xxx.xxx.xxx - - [24/Aug/2024:22:32:18 +0000] "GET /Items/5203a7e70b667d2cfaee2cd2eb3de082/Images/Primary?MaxHeight=330&MaxWidth=234&quality=90&Tags=null HTTP/2.0" 404 57 "-" "Roku/DVP-13.1 (13.1.4.01510-30)"
xxx.xxx.xxx - - [24/Aug/2024:22:32:18 +0000] "GET /Items/af409665d3461f32d0c20c3ad9dcf514/Images/Primary?MaxHeight=330&MaxWidth=234&quality=90&Tags=null HTTP/2.0" 404 59 "-" "Roku/DVP-13.1 (13.1.4.01510-30)"
xxx.xxx.xxx - - [24/Aug/2024:22:32:18 +0000] "GET /Items/fbef2493eb1b8191acf97cd81af4992f/Images/Primary?MaxHeight=330&MaxWidth=234&quality=90&Tags=null HTTP/2.0" 404 52 "-" "Roku/DVP-13.1 (13.1.4.01510-30)"
xxx.xxx.xxx - - [24/Aug/2024:22:32:19 +0000] "GET /Users/777753c236ad474886eac892a7a6b8a1/Items/9748abb9d039731eec9970360f1b46e1/SpecialFeatures HTTP/2.0" 200 2 "-" "Roku/DVP-13.1 (13.1.4.1510-30)"

Screenshots

screenshot from crowdsec cli about what/why it got banned.

Connection Information

Server is remote. Reverse proxy'd through NGINX

Additional context

As mentioned earlier, this is pretty much identical to these over on Swiftfin's page: https://github.com/jellyfin/Swiftfin/issues/690 https://github.com/jellyfin/Swiftfin/issues/884

I already have a work around with Crowdsec (added a whitelist to that /Items/*/Images/* path) after mentioning this on their Discord and getting some help, however I figured I'd mention it here as well since Swiftfin also has a matching issue.

cewert commented 2 months ago

Changing this to a feature request since we've never claimed to support Crowdsec

ConfusedOwlet commented 2 months ago

All good. There's a workaround on Crowdsec's side now that I submitted and was merged.

I just marked it as a bug due to the similarity to the Swiftfin issue that was considered a bug due to how they looked for images (trying to grab images even if they don't exist). This was the issue that they opened (and closed once fixed) about grabbing the images. https://github.com/jellyfin/Swiftfin/issues/884

cewert commented 2 months ago

marked it as a bug due to the similarity to the Swiftfin issue that was considered a bug due to how they looked for images (trying to grab images even if they don't exist)

Interesting thanks I missed that before

jellyfin / jellyfin-roku