starred/audiobookshelf-app
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf-app.git synced 2026-07-25 14:08:35 +02:00
Code Issues 454 Packages Projects Releases 10 Wiki Activity

Cross-Origin-Resource-Policy causes invalid covers #611

New Issue
Closed
opened 2026-04-24 23:29:56 +02:00 by adam · 5 comments
adam commented 2026-04-24 23:29:56 +02:00
Owner
Copy Link
Copy Source

Originally created by @PleaseStopAsking on GitHub (Jul 3, 2023).

When attempting to configure my caddy proxy using secure baseline values, I discovered that the iOS app breaks if the Cross-Origin-Resource-Policy header is set to anything other than cross-origin which is less than ideal. This issue is not present via browser on the same device nor from other browsers on my laptop and appears to be isolated to the iOS app (unable to test via Android).

Steps to reproduce

  1. Setup reverse proxy with the Cross-Origin-Resource-Policy header configured with either same-site or same-origin as the value.

Example Caddy Config

books.example.com:443 {
	reverse_proxy audiobookshelf:80
	encode gzip zstd
	header {
		Permissions-Policy: "interest-cohort=(), camera=(), geolocation=(), microphone=(), payment=(), usb=(), vr=()"
		Access-Control-Allow-Methods: GET, OPTIONS, PUT
		Access-Control-Max-Age: 100
		Cross-Origin-Opener-Policy: same-origin
		Cross-Origin-Resource-Policy: same-site
		Server: null
		Vary: Origin
		X-Forwarded-Proto: https
		Strict-Transport-Security: "max-age=31536000; includeSubDomains; preload"
		X-Frame-Options: DENY
		X-Content-Type-Options: nosniff
		X-XSS-Protection: "1; mode=block"
		Referrer-Policy: strict-origin-when-cross-origin
		X-Robots-Tag: none,noarchive,nosnippet,notranslate,noimageindex
}
  1. Login to the server via the app
  2. Switch the Cross-Origin-Resource-Policy value to cross-origin and the problem goes away.

Expected behaviour

The covers should be visible

Actual behaviour

All the covers show as blank with Invalid Cover text

Environment data

Audiobookshelf Version:

  • [ 0.9.65-beta ] iOS App?

iOS Issue

iOS Version: 16.5.1

iPhone model: 14 Pro

Originally created by @PleaseStopAsking on GitHub (Jul 3, 2023). When attempting to configure my caddy proxy using secure baseline values, I discovered that the iOS app breaks if the `Cross-Origin-Resource-Policy` header is set to anything other than `cross-origin` which is less than ideal. This issue is not present via browser on the same device nor from other browsers on my laptop and appears to be isolated to the iOS app (unable to test via Android). ### Steps to reproduce 1. Setup reverse proxy with the `Cross-Origin-Resource-Policy` header configured with either `same-site` or `same-origin` as the value. **Example Caddy Config** ``` books.example.com:443 { reverse_proxy audiobookshelf:80 encode gzip zstd header { Permissions-Policy: "interest-cohort=(), camera=(), geolocation=(), microphone=(), payment=(), usb=(), vr=()" Access-Control-Allow-Methods: GET, OPTIONS, PUT Access-Control-Max-Age: 100 Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-site Server: null Vary: Origin X-Forwarded-Proto: https Strict-Transport-Security: "max-age=31536000; includeSubDomains; preload" X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: "1; mode=block" Referrer-Policy: strict-origin-when-cross-origin X-Robots-Tag: none,noarchive,nosnippet,notranslate,noimageindex } ``` 2. Login to the server via the app 3. Switch the `Cross-Origin-Resource-Policy` value to `cross-origin` and the problem goes away. ### Expected behaviour The covers should be visible ### Actual behaviour All the covers show as blank with Invalid Cover text ### Environment data Audiobookshelf Version: - [ 0.9.65-beta ] iOS App? #### iOS Issue iOS Version: 16.5.1 iPhone model: 14 Pro
adam added the bug label 2026-04-24 23:29:56 +02:00
adam closed this issue 2026-04-24 23:29:58 +02:00
adam commented 2026-04-24 23:30:01 +02:00
Author
Owner
Copy Link
Copy Source

@advplyr commented on GitHub (Sep 12, 2023):

I think this may be resolved in the next release with the fix applied in #781

@advplyr commented on GitHub (Sep 12, 2023): I think this may be resolved in the next release with the fix applied in #781
adam commented 2026-04-24 23:30:02 +02:00
Author
Owner
Copy Link
Copy Source

@advplyr commented on GitHub (Sep 19, 2023):

I don't think this will be resolved in the latest anymore because of a limitation in the plugin

@advplyr commented on GitHub (Sep 19, 2023): I don't think this will be resolved in the latest anymore because of a limitation in the plugin
adam commented 2026-04-24 23:30:03 +02:00
Author
Owner
Copy Link
Copy Source

@advplyr commented on GitHub (Nov 18, 2023):

Hopefully this is resolved in v0.9.67-beta but let me know. I made more updates mentioned in #781

@advplyr commented on GitHub (Nov 18, 2023): Hopefully this is resolved in v0.9.67-beta but let me know. I made more updates mentioned in #781
adam commented 2026-04-24 23:30:03 +02:00
Author
Owner
Copy Link
Copy Source

@rbqbjyur commented on GitHub (Nov 29, 2024):

Hopefully this is resolved in v0.9.67-beta but let me know. I made more updates mentioned in #781

This is happening now on the Android App.
I only recently started using Audiobookshelf so am not sure if this has been happening since the changes you mentioned in #781, or not.

For clarity:

Browser on Linux work fine
Browser on Android works fine
Android App if going direct to IP:Port works fine

It's when the Android App is accessing via reverse proxy and Cross-Origin-Resource-Policy is set to 'same-site', results in "Invalid Cover". As initial issue, setting to 'cross-origin' allows the covers to appear on the Android App.

App: 0.9.77-beta
This is on Android 15
Server is 2.17.2

If you would like any other details, or want me to try something please let me know.

Thought it would make sense to append to this issue, rather than create a new one.

@rbqbjyur commented on GitHub (Nov 29, 2024): > Hopefully this is resolved in v0.9.67-beta but let me know. I made more updates mentioned in #781 This is happening now on the Android App. I only recently started using Audiobookshelf so am not sure if this has been happening since the changes you mentioned in #781, or not. For clarity: Browser on Linux work fine Browser on Android works fine Android App if going direct to IP:Port works fine It's when the Android App is accessing via reverse proxy and Cross-Origin-Resource-Policy is set to 'same-site', results in "Invalid Cover". As initial issue, setting to 'cross-origin' allows the covers to appear on the Android App. App: 0.9.77-beta This is on Android 15 Server is 2.17.2 If you would like any other details, or want me to try something please let me know. Thought it would make sense to append to this issue, rather than create a new one.
adam commented 2026-04-24 23:30:04 +02:00
Author
Owner
Copy Link
Copy Source

@bishtawi commented on GitHub (Feb 24, 2026):

I am also running into this bug with the Android app with the Cross-Origin-Resource-Policy header set to same-site.

@advplyr Any chance we could reopen the issue?

@bishtawi commented on GitHub (Feb 24, 2026): I am also running into this bug with the Android app with the `Cross-Origin-Resource-Policy` header set to `same-site`. @advplyr Any chance we could reopen the issue?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
android
android auto
backlog
bug
enhancement
ereader
help wanted
iOS
progress sync
pull-request
Mirrored from GitHub Pull Request
 sleep timer
unable to reproduce
waiting
No labels bug
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf-app#611