GET requests to /api for unauthenticated users

[liability4400]

Hello everyone,

I'm just gonna start of by saying that I absolutely love this project and how complete it feels for my own media server.

I am running Jellyseerr 1.5.0 behind Nginx Proxy Manager. I have a couple other apps publicly accesible through NPM as well. For this reason I installed fail2ban on the host and the filter I set up is for 401, 403, 404 and 405 error codes on all of my proxy hosts. I like it this way because on Gotify, for example, an incorrect password would result in a 403 request, triggering my filter and eventually resulting in a ban. This way ( I think) I have a system-wide anti-bot system for my homelab.

The problem is that Jellyseerr apparently makes requests to the /api/v1/settings/radarr and /api/v1/settings/sonarr endpoints immediately after a user logs in or when they click on a movie or show poster. This wouldn't be a problem if I were the only user with admin rights or when accesing from within my home network (as my LAN subnet is whitelisted from the filter) but when any of my other users sign in, after about 3 page loads they get banned.

NPM Access logs (sanitized - 1.2.3.4 is me testing on mobile data, authenticated as a non-admin user):

[24/Jul/2023:13:55:05 +0000] - 307 307 - GET https my.domain.tld "/" [Client 1.2.3.4] [Length 0] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "-"
[24/Jul/2023:13:55:05 +0000] - 200 200 - GET https my.domain.tld "/login" [Client 1.2.3.4] [Length 36492] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "-"
[24/Jul/2023:13:55:07 +0000] - 401 401 - GET https my.domain.tld "/api/v1/auth/me" [Client 1.2.3.4] [Length 123] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/login"
[24/Jul/2023:13:55:07 +0000] - 200 200 - GET https my.domain.tld "/api/v1/backdrops" [Client 1.2.3.4] [Length 701] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/login"
[24/Jul/2023:13:55:07 +0000] - 401 401 - GET https my.domain.tld "/api/v1/auth/me" [Client 1.2.3.4] [Length 123] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/login"
[24/Jul/2023:13:55:07 +0000] - 200 200 - GET https my.domain.tld "/api/v1/settings/public" [Client 1.2.3.4] [Length 521] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/login"
[24/Jul/2023:13:55:08 +0000] - 200 200 - GET https my.domain.tld "/api/v1/status" [Client 1.2.3.4] [Length 108] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/login"
[24/Jul/2023:13:55:08 +0000] - 200 200 - GET https my.domain.tld "/site.webmanifest" [Client 1.2.3.4] [Length 361] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/login"
[24/Jul/2023:13:55:46 +0000] - 200 200 - POST https my.domain.tld "/api/v1/auth/jellyfin" [Client 1.2.3.4] [Length 1084] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/login"
[24/Jul/2023:13:55:46 +0000] - 200 200 - GET https my.domain.tld "/api/v1/auth/me" [Client 1.2.3.4] [Length 1113] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/login"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/settings/discover" [Client 1.2.3.4] [Length 2307] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 304 304 - GET https my.domain.tld "/api/v1/auth/me" [Client 1.2.3.4] [Length 0] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/request?filter=all&take=10&sort=modified&skip=0" [Client 1.2.3.4] [Length 23537] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/discover/genreslider/movie" [Client 1.2.3.4] [Length 13928] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/discover/genreslider/tv" [Client 1.2.3.4] [Length 11558] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/discover/tv?page=1&firstAirDateGte=2023-07-24" [Client 1.2.3.4] [Length 7050] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/discover/movies?page=1&primaryReleaseDateGte=2023-07-24" [Client 1.2.3.4] [Length 14230] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/discover/movies?page=1&genre=28" [Client 1.2.3.4] [Length 23355] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/request/201" [Client 1.2.3.4] [Length 3107] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/request/198" [Client 1.2.3.4] [Length 3309] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/request/186" [Client 1.2.3.4] [Length 3098] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/request/200" [Client 1.2.3.4] [Length 3309] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/request/188" [Client 1.2.3.4] [Length 3116] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/request/199" [Client 1.2.3.4] [Length 3309] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/request/195" [Client 1.2.3.4] [Length 3116] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/request/185" [Client 1.2.3.4] [Length 3292] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/request/170" [Client 1.2.3.4] [Length 3104] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/request/187" [Client 1.2.3.4] [Length 3164] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/discover/movies?page=1" [Client 1.2.3.4] [Length 23703] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/discover/trending?page=1" [Client 1.2.3.4] [Length 24727] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/discover/tv?page=1" [Client 1.2.3.4] [Length 8739] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/movie/447332" [Client 1.2.3.4] [Length 107399] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/movie/1008042" [Client 1.2.3.4] [Length 30217] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:47 +0000] - 200 200 - GET https my.domain.tld "/api/v1/discover/tv/network/49?page=1" [Client 1.2.3.4] [Length 19810] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:48 +0000] - 200 200 - GET https my.domain.tld "/api/v1/discover/movies?page=2&genre=28" [Client 1.2.3.4] [Length 20190] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:48 +0000] - 200 200 - GET https my.domain.tld "/api/v1/discover/tv?page=2&firstAirDateGte=2023-07-24" [Client 1.2.3.4] [Length 6822] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:48 +0000] - 200 200 - GET https my.domain.tld "/api/v1/discover/movies?page=2&primaryReleaseDateGte=2023-07-24" [Client 1.2.3.4] [Length 8991] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:48 +0000] - 200 200 - GET https my.domain.tld "/api/v1/discover/tv?page=2" [Client 1.2.3.4] [Length 17793] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:48 +0000] - 200 200 - GET https my.domain.tld "/api/v1/discover/movies?page=2" [Client 1.2.3.4] [Length 20747] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:48 +0000] - 200 200 - GET https my.domain.tld "/api/v1/discover/trending?page=2" [Client 1.2.3.4] [Length 17298] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:48 +0000] - 200 200 - GET https my.domain.tld "/api/v1/discover/tv/network/49?page=2" [Client 1.2.3.4] [Length 17499] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/"
[24/Jul/2023:13:55:57 +0000] - 304 304 - GET https my.domain.tld "/api/v1/auth/me" [Client 1.2.3.4] [Length 0] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/movie/1083862"
[24/Jul/2023:13:55:58 +0000] - 200 200 - GET https my.domain.tld "/api/v1/movie/1083862" [Client 1.2.3.4] [Length 8007] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/movie/1083862"
[24/Jul/2023:13:55:58 +0000] - 403 403 - GET https my.domain.tld "/api/v1/settings/radarr" [Client 1.2.3.4] [Length 75] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/movie/1083862"
[24/Jul/2023:13:55:58 +0000] - 403 403 - GET https my.domain.tld "/api/v1/settings/sonarr" [Client 1.2.3.4] [Length 75] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/movie/1083862"
[24/Jul/2023:13:55:58 +0000] - 200 200 - GET https my.domain.tld "/api/v1/movie/1083862/ratings" [Client 1.2.3.4] [Length 144] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/movie/1083862"
[24/Jul/2023:13:55:58 +0000] - 200 200 - GET https my.domain.tld "/api/v1/movie/1083862/recommendations?page=1" [Client 1.2.3.4] [Length 55] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/movie/1083862"
[24/Jul/2023:13:55:58 +0000] - 200 200 - GET https my.domain.tld "/api/v1/movie/1083862/similar?page=1" [Client 1.2.3.4] [Length 13732] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/movie/1083862"
[24/Jul/2023:13:55:59 +0000] - 200 200 - GET https my.domain.tld "/api/v1/movie/1083862/similar?page=2" [Client 1.2.3.4] [Length 11681] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/movie/1083862"
[24/Jul/2023:13:56:03 +0000] - 403 403 - GET https my.domain.tld "/api/v1/settings/sonarr" [Client 1.2.3.4] [Length 75] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/movie/1083862"
[24/Jul/2023:13:56:07 +0000] - 200 200 - GET https my.domain.tld "/api/v1/status" [Client 1.2.3.4] [Length 108] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/movie/1083862"
[24/Jul/2023:13:56:07 +0000] - 304 304 - GET https my.domain.tld "/api/v1/auth/me" [Client 1.2.3.4] [Length 0] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/movie/1083862"
[24/Jul/2023:13:56:08 +0000] - 403 403 - GET https my.domain.tld "/api/v1/settings/radarr" [Client 1.2.3.4] [Length 75] [Gzip -] [Sent-to jellyseerr] "Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0" "https://my.domain.tld/movie/1083862"

My fail2ban filter regex looks like this:

[INCLUDES]

[Definition]

failregex = ^.* (405|404|403|401|\-) (405|404|403|401) - .* \[Client <HOST>\] \[Length .*\] .* \[Sent-to <F-CONTAINER>.*</F-CONTAINER>\] <F-USERAGENT>".*"</F-USERAGENT> .*$

ignoreregex = ^.* (404|\-) (404) - .*".*(\.png|\.txt|\.jpg|\.ico|\.js|\.css|\.ttf|\.woff|\.woff2)(/)*?" \[Client <HOST>\] \[Length .*\] ".*" .*$

While the .local jail file is this:

[DEFAULT]
# "bantime.increment" allows to use database for searching of previously banned ip's to increase a
# default ban time using special formula, default it is banTime * 1, 2, 4, 8, 16, 32...
bantime.increment = true

# "bantime.rndtime" is the max number of seconds using for mixing with random time
# to prevent "clever" botnets calculate exact time IP can be unbanned again:
bantime.rndtime = 2048

# following example can be used for small initial ban time (bantime=60) - it grows more aggressive at begin,
# for bantime=60 the multipliers are minutes and equal: 1 min, 5 min, 30 min, 1 hour, 5 hour, 12 hour, 1 day, 2 day
bantime.multipliers = 1 5 30 60 300 720 1440 2880

[npm-forceful]
# bots that trigger too many 403 or 404
# logs are comming from reverse proxy "nginx proxy manager"
enabled = true
ignoreip = 127.0.0.0/8 10.0.0.0/8 172.18.0.0/16 192.168.0.0/16
action = docker-npm
filter = npm-forceful
chain = DOCKER-USER
logpath = /path/to/npm/logs/proxy-host-*_access.log
maxretry = 6
findtime = 120
bantime = 600

I'm not knowledgeable at all with web apps and web requests so I have no insight to offer on this at all unfortunately. I'm not sure why unauthenticated users make API requests to the backend but I ended up "solving" the issue by adding this code block to my NPM Jellyseerr proxy host in the Advanced tab:

location /api/v1/settings/sonarr {
    return 302;
}
location /api/v1/settings/radarr {
    return 302;
}

This fixes the unintentional banning of normal users and, as far as I can tell, it still does not expose the API through the reverse proxy. I tried other redirect codes but those resulted in loops and ultimately breaking the app. This seems to be working so far although I am still waiting for it to break something. I would love to see any better solution to this.

[Fallenbagel]

You should follow the fail2ban steps for jellyseerr in docs.overseerr.dev. As in the regex should only be looking for the sign in attempts. If you want to block api access externally you can turn on csrf but do read up on it. The s3tting is in settings > general

[Olivier-Pickup]

same here but with bunkerity (software firewall) how can I stop jellyseerr making those useless request from user without admin right and external users ?