New security feature with respect to a Plex plug-in that acts as a client

Dev Community Dev/API Corner
1

Earlier this year I put together a new Plex plugin to provide a feature I’ve wanted in Plex for years: Shuffle By Album.

To get it work, I had the plug-in act as a client to the server that is running the plug-in (which is a bit of a snake swallowing its own tail, I know!). It creates a new playlist on the server, and then gives the user an option to start the playlist on one of the local clients. Unfortunately, the new server security breaks this, since the plug-in client code is connecting to the server as ‘localhost’, and with latest server versions I can’t whitelist connections from localhost/127.0.0.1.

I’m not sure how to fix this. I could:

  1. Have the plug-in settings accept the login credentials for the plex account, but that seems wrong.
  2. Rework the plug-in to somehow use a different mechanism to achieve the same goal of a shuffle-by-album feature, but I don’t have any other idea how to do this at the moment.
  3. Petition Plex developers to integrate this feature and obviate the need for the plug-in :slight_smile:
  4. Petition Plex developers to for some way to trust plug-ins? Not sure how this would work

I’m open to any suggestions!

(I posted this here under Preview Releases and not Channel Development because this isn’t a general issue yet. I’ll be happy to move discussion if we need to)

Thanks!

2

This was solved here: https://forums.plex.tv/discussion/comment/1243418#Comment_1243418

There is an environment variable called PLEXTOKEN which is accessible within the plug-in code which can be used for the API requests.