Lunatria Second Devlog:
After getting Lunatria working in the browser, I wanted the Jellyfin mobile app to work as well. Unfortunately, my browser authentication flow couldn’t be reused directly inside the app, so I had to figure out how the mobile client authenticated differently.
My first hypothesis was that Jellyfin explicitly identified whether a request came from the browser or the mobile app. To test this, I created a temporary domain (observe-jellyfin.lunatria.com) and logged every request passing through Nginx (Screenshot 1 shows the logging setup).
However, this turned out not to be the case.
After inspecting requests from both the web and mobile app, I started comparing the User-Agent headers. After going through tens of requests, I finally noticed the only consistent difference: two tiny letters in the User-Agent — wv, meaning WebView (Screenshot 2 shows the two User-Agent strings).
After looking it up, I learned that wv indicates an embedded Android WebView. At first I wasn’t sure this was the real distinction, but after testing across multiple devices, I confirmed it: wv effectively separates mobile app traffic from web traffic.
To handle this, I added a variable in the Nginx configuration to split routing between web and app traffic (Screenshot 3 shows the config change).
However, authentication was still an issue.
On the web version of Jellyfin, I route traffic through a special HTML page that uses the SSO session to fetch and store the Jellyfin auth token. In the mobile app, this approach doesn’t work.
After some consideration, I decided to route all mobile app traffic directly to Jellyfin except for one endpoint: the authentication endpoint.
On Jellyfin, this is /Users/AuthenticateByName. I route this request to my backend instead (Screenshot 4 shows the routing logic). The backend uses the SSO credentials provided by the user in the Jellyfin app, retrieves the corresponding Jellyfin auth token (stored securely and encrypted), and responds in place of Jellyfin.
And success — the Jellyfin mobile app is now fully accessible through Lunatria.
(You can check the Nginx configs in the repo.)