starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Enhancement]: Allow cross origin API requests from the web #3063

New Issue
Closed
opened 2026-04-25 00:13:21 +02:00 by adam · 7 comments
adam commented 2026-04-25 00:13:21 +02:00
Owner
Copy Link
Copy Source

Originally created by @elliott-parkinson on GitHub (Oct 30, 2025).

Type of Enhancement

Server Backend

Describe the Feature/Enhancement

I would like to be able to make requests from a web page on another origin to my audible instance. Right now I am limited from doing so because of the following code:

(TokenManager.js)

setRefreshTokenCookie(req, res, refreshToken) { res.cookie('refresh_token', refreshToken, { httpOnly: true, secure: req.secure || req.get('x-forwarded-proto') === 'https', sameSite: 'lax', maxAge: this.RefreshTokenExpiry * 1000, path: '/' }) }

'sameSite' being set to 'lax' prevents me from making these requests. So when I make a request with credentials: "include' I am unable to do so because the cookie wasnt set during my login in the first place. Basically this means I can make native apps but not web apps to interact with the audiobookshelf server.

The specific feature / implementation I would like is a toggle to in the UI settings where I can change this to "none" based upon it. I would suggest this is below the "Allow embedding in an iframe" toggle.

Why would this be helpful?

I am trying to build an alternative web frontend for audiobookshelf as I have some personal UI preferences and would also like to help a friend of mine who is having issues on iOS.

Future Implementation (Screenshot)

The specific feature / implementation I would like is a toggle to in the UI settings where I can change the sameSite cookie setting to "none" based upon it. I would suggest this is below the "Allow embedding in an iframe" toggle.

Alternatively - maybe if we are doing CORS from one of the allowed origins we can just have it set to none instead of lax? Though I think a setting in preferences may be more desirable as it requires intent.

Audiobookshelf Server Version

v2.30.0

Current Implementation (Screenshot)

No response

Originally created by @elliott-parkinson on GitHub (Oct 30, 2025). ### Type of Enhancement Server Backend ### Describe the Feature/Enhancement I would like to be able to make requests from a web page on another origin to my audible instance. Right now I am limited from doing so because of the following code: _(TokenManager.js)_ ` setRefreshTokenCookie(req, res, refreshToken) { res.cookie('refresh_token', refreshToken, { httpOnly: true, secure: req.secure || req.get('x-forwarded-proto') === 'https', sameSite: 'lax', maxAge: this.RefreshTokenExpiry * 1000, path: '/' }) }` 'sameSite' being set to 'lax' prevents me from making these requests. So when I make a request with credentials: "include' I am unable to do so because the cookie wasnt set during my login in the first place. Basically this means I can make native apps but not web apps to interact with the audiobookshelf server. The specific feature / implementation I would like is a toggle to in the UI settings where I can change this to "none" based upon it. I would suggest this is below the "Allow embedding in an iframe" toggle. ### Why would this be helpful? I am trying to build an alternative web frontend for audiobookshelf as I have some personal UI preferences and would also like to help a friend of mine who is having issues on iOS. ### Future Implementation (Screenshot) The specific feature / implementation I would like is a toggle to in the UI settings where I can change the sameSite cookie setting to "none" based upon it. I would suggest this is below the "Allow embedding in an iframe" toggle. Alternatively - maybe if we are doing CORS from one of the allowed origins we can just have it set to none instead of lax? Though I think a setting in preferences may be more desirable as it requires intent. ### Audiobookshelf Server Version v2.30.0 ### Current Implementation (Screenshot) _No response_
adam added the enhancement label 2026-04-25 00:13:21 +02:00
adam closed this issue 2026-04-25 00:13:21 +02:00
adam commented 2026-04-25 00:13:21 +02:00
Author
Owner
Copy Link
Copy Source

@sir-wilhelm commented on GitHub (Oct 30, 2025):

If you are on 2.30 you should be able to allow that in the config: /audiobookshelf/config

Image
@sir-wilhelm commented on GitHub (Oct 30, 2025): If you are on 2.30 you should be able to allow that in the config: `/audiobookshelf/config` <img width="1100" height="797" alt="Image" src="https://github.com/user-attachments/assets/48aac537-0128-4770-89a1-41a69bd23028" />
adam commented 2026-04-25 00:13:21 +02:00
Author
Owner
Copy Link
Copy Source

@Vito0912 commented on GitHub (Oct 30, 2025):

@sir-wilhelm That's just the CORS origin.

Apart from that, the request OP wants to make is very risky and should not be implemented imho.

It would cause serious security issues. There are good reasons for this.

If you want to build a custom client (or interact with ABS in general), you can set the CORS Origins and use the API.

@Vito0912 commented on GitHub (Oct 30, 2025): @sir-wilhelm That's just the CORS origin. Apart from that, the request OP wants to make is very risky and should not be implemented imho. It would cause serious security issues. There are good reasons for this. If you want to build a custom client (or interact with ABS in general), you can set the CORS Origins and use the API.
adam commented 2026-04-25 00:13:21 +02:00
Author
Owner
Copy Link
Copy Source

@elliott-parkinson commented on GitHub (Oct 30, 2025):

Setting CORS origin and using the API is not a viable option in this case because I am on a different domain I do not get the cookies being set. This means that whilst I get an authorized response and I get my user object etc - I have no refresh token. This means that my only current option is to store the username and password client side and continuously re-login - which I would consider to be extremely unsafe.

Would a safer alternative perhaps be to send the refresh token in cookies and the response?

@elliott-parkinson commented on GitHub (Oct 30, 2025): Setting CORS origin and using the API is not a viable option in this case because I am on a different domain I do not get the cookies being set. This means that whilst I get an authorized response and I get my user object etc - I have no refresh token. This means that my only current option is to store the username and password client side and continuously re-login - which I would consider to be extremely unsafe. Would a safer alternative perhaps be to send the refresh token in cookies and the response?
adam commented 2026-04-25 00:13:21 +02:00
Author
Owner
Copy Link
Copy Source

@Vito0912 commented on GitHub (Oct 30, 2025):

It's not less secure. If done correctly, it could even be more secure. I'm not saying this is a good idea at all.

But aside from that, you can already retrieve the refresh token if you include x-return-tokens as a request header.

@Vito0912 commented on GitHub (Oct 30, 2025): It's not less secure. If done correctly, it could even be more secure. I'm not saying this is a good idea at all. But aside from that, you can already retrieve the refresh token if you include `x-return-tokens` as a request header.
adam commented 2026-04-25 00:13:21 +02:00
Author
Owner
Copy Link
Copy Source

@elliott-parkinson commented on GitHub (Oct 30, 2025):

Ah! I was not aware of / had not come accross the x-return-tokens yet. This has in fact fully resolved my issue and is the correct solution imo.

Thank you.

@elliott-parkinson commented on GitHub (Oct 30, 2025): Ah! I was not aware of / had not come accross the x-return-tokens yet. This has in fact fully resolved my issue and is the correct solution imo. Thank you.
adam commented 2026-04-25 00:13:21 +02:00
Author
Owner
Copy Link
Copy Source

@Vito0912 commented on GitHub (Oct 30, 2025):

Nice, if not needed, can you close this issue then?

Thanks! Also if you are open to it, might you want to share your client? I keep a collection of pretty much every client

@Vito0912 commented on GitHub (Oct 30, 2025): Nice, if not needed, can you close this issue then? Thanks! Also if you are open to it, might you want to share your client? I keep a collection of pretty much every client
adam commented 2026-04-25 00:13:22 +02:00
Author
Owner
Copy Link
Copy Source

@elliott-parkinson commented on GitHub (Oct 30, 2025):

I will happily share my client when complete - I intend on making it publicly available.

I will send it to your contact email on your portfolio website!

Thanks again.

@elliott-parkinson commented on GitHub (Oct 30, 2025): I will happily share my client when complete - I intend on making it publicly available. I will send it to your contact email on your portfolio website! Thanks again.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#3063
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?