Reply to thread

Message: [QUOTE="Bombastus, post: 91436, member: 2178"] Plex gives owner access to apps that connect through its network exceptions without signing in, including control over server settings. The permission extends to every library on that server. An exception you added for an old TV may cover far more than that screen. A whole subnet can include laptops and other reachable devices. Anyone connecting without signing in from a matching address receives the same owner treatment. A claimed server normally requires an authorized account. While applying [B][URL='https://goldmidi.com/community/threads/plex-pushes-fixes-for-media-server-and-desktop-flaws.76841/']Plex’s server and desktop security patches[/URL][/B], check whether a network exception grants access to devices you meant to restrict. [HEADING=2]Local playback uses a different setting[/HEADING] In Plex Web, open the server’s Network settings and enable Show Advanced. Find “List of IP addresses and networks that are allowed without auth.” Read each entry as permission to skip an account check. A single IP entry covers one address, while a subnet entry covers every matching address across that network. Public internet addresses aren’t valid entries for the authentication exception list. Plex also ignores an entry for 127.0.0.1 when the server is signed in. A loopback entry is therefore no substitute for checking access from another machine on your LAN. The nearby LAN Networks field serves a different purpose. It tells Plex which addresses count as local when applying bandwidth controls. This setting requires an active Plex Pass subscription on the server owner’s account. Suppose your TV sits on another home subnet and Plex applies remote bandwidth limits to its playback. Putting that subnet in the authentication exception list grants extra access without correcting the setting responsible for that classification. If you no longer need an exception, remove it and save the change. An old app that cannot sign in may lose access afterward. Keeping an exception for one device still gives requests made without signing in owner privileges. [HEADING=2]Docker can retain an exception you removed[/HEADING] The official plexinc/pms-docker image accepts an ALLOWED_NETWORKS environment variable. During initial setup, a nonempty value is written into Plex’s saved allowedNetworks preference. The two names refer to the same exception. Removing the variable from your Compose file doesn’t erase the saved preference. The initialization code skips that update when the variable is empty, leaving the existing value untouched. This can survive a container replacement when you keep the same configuration storage. The replacement reads the server preferences already saved there. A deployment file with no exception listed can therefore run a server that still has one. A saved Docker value can also undo a change made through Plex’s interface. If the deployment still supplies a nonempty ALLOWED_NETWORKS value, a recreated container can write it back during its initial setup. Remove the unwanted value from the deployment and clear the saved exception in Plex. Keep the server’s existing configuration storage. Throwing away that storage to remove one preference also discards settings you weren’t trying to change. For manual inspection on Linux, allowedNetworks lives in Preferences.xml within the server’s data directory. Use the web interface when you can still access it, and check the displayed value again after replacing the container. [HEADING=2]A gateway address can make your test misleading[/HEADING] Bridge networking can change the address Plex sees for [B]local connections that skip account checks[/B]. A localhost connection from the Docker host, for example, can arrive under the Docker gateway’s address. An exception for that gateway identifies the address Plex sees. It doesn’t establish which person originally made the request. If other requests arrive under the same address, they can match the same exception. Check access from another computer on the network you actually want to restrict. Open the server’s local web app using its LAN address, port 32400, and the /web path. Use a fresh private browsing session and leave it signed out. In Chrome, close existing Incognito windows before opening a new one. Opening another Incognito window while one remains open continues the existing session, which may already contain a Plex login. Look for access to your personal libraries and server settings, rather than treating a loaded web page as proof of access. A familiar library opening in your usual browser may simply mean you’re still signed in. Turning off GDM discovery also leaves the authentication exception itself in place. Discovery helps compatible Plex apps find the server automatically on your local network. A device that already knows the server’s address can still try to connect directly. If you also reach Plex through a reverse proxy, test that address separately without signing in. Different connection paths can produce different results. Passing the direct LAN check doesn’t establish what the proxy path permits. [/QUOTE]

Name