Ever since the announcement of the new Plex/Web client beta accessed through plex.tv/web I’ve tried to access my library through that site, resulting in total failure when using my normal browser, which is Firefox equipped with the standard security addon NoScript. All I could see on the plex.tv/web pages was a queue, and some server/device lists, but no trace of the PMS library content.
This has always worked fine with the old Plex/Web implementation, once I whitelisted its URL for NoScript, but doing the same for the new Plex/Web didn’t work.
Yesterday a dialog with ericmatthys in another thread of this forum led me to experiment with various NoScript features, revealing exactly why the new Plex/Web client is being blocked from accessing the PMS library, and I also found a simple way to disable that blocking without losing any security features (as would be the case if disabling NoScript).
The blocking is caused by the “ABE” component of NoScript. (ABE == Application Boundaries Enforcer)
This is enabled by default in NoScript and prevents an Internet-based Web application from cross-site scripting to interface with your local PMS.
That’s why it only affects the new Plex/Web and not the old implementation, since that script bundle resides on your local PMS computer (no cross-site scripting).
A simple way to disable this blocking, uniquely for the new Plex/Web application, is to add a new rule for the ABE engine.
To do this, proceed as follows:
1: Open the NoScript options dialog.
– Right-click the NoScript icon in the toolbar and select “Options…” in the popup menu.
2: In the main NoScript Options dialog, left-click the “Advanced” tab
3: Inside the “Advanced” tab section, left-click the “ABE” subtab
– Inside the “ABE” subtab section you should now see a few selectable ‘tick-boxes’ above two rectangular fields.
– The leftmost of those fields is used to select an ABE ruleset for inspection/editing
– The rightmost field is for display/editing of the selected ruleset (like a mini text editor)
4: In the leftmost field left-click “SYSTEM”
– The rightmost field should now display the “SYSTEM” ruleset as:
# Prevent Internet sites from requesting LAN resources.5: In the rightmost field, insert a new line above “Deny”, containing “Accept from app.plex.tv/web/app”
Site LOCAL
Accept from LOCAL
Deny
– The rightmost field should now display the modified ruleset as:
# Prevent Internet sites from requesting LAN resources.6: In the bottom row of buttons in the main Noscript options dialog, left-click the “OK” button
Site LOCAL
Accept from LOCAL
Accept from app.plex.tv/web/app
Deny
7: The new ruleset is now active and ready for use (restart is not needed)
Note that you still have to give normal NoScript scripting permission for the plex.tv/web site,
as that permission is separate from the ABE operations.
With the normal script permissions set for the plex.tv page (I do it permanently) and the ABE ruleset modified as above, the plex.tv/web access now works fine for me.
The new Plex/Web client may still have some other issues due to its beta status, but I no longer have any problems to browse what it has to offer with my fully protected Firefox setup.
Edit:
Thanks go to user @zivizivi who posted some time ago with the info that the plex.tv site has changed the cross-script URL from the original “plex.tv/web/app” to the current “app.plex.tv/web/app”. I’ve now modified my original post text above to reflect the current usage.
Best regards: dlanor
