Security issue with third party clients

Server Version#:
Player Version#:

i have to take my server offline to stop this, the third part client Plezy is bugged, whoever use it is locked into the server and their session cannot be terminated nor can i do anything to them, i already reported this to plezy author but it seem this is a bug in plex end as well for third part clients?

1 Like

for example, if i go to admin dashboard, the hover red box to “stop playback” doesnt even show for plezy clients

author responded that this is plex issue not his issue, i am not sure how plezy is able to hold plex hostage like this, but any solution is welcomed, settings in server side such as terminate after x paused or kill sessions is not applicable to plezy, the client flat out ignore it

There a couple of parts to this feature, a) a client must pass a unique X-Plex-Session-Identifier header for each playback session and b) to display the termination message the client must implement this.

It sounds like the client may not be properly starting playback sessions.

anyway from plex end to stop clients that are not respecting this? i cant block people from using this tool except to kick the user out completely at the moment

No, if they access to the server they will be able to access things.

If the user is not respecting your wishes then removing the share is the only effective option.

Still feel like a client shouldnt be able to ignore plex server commands, but for now all i can do is kick out users who use plezy

1 Like

so is this ok? how is this ok?

Since Plezy author claims all third party client have the power to do this and bypass a lot due to plex api, can plex pls address this?

Out of curiosity, how often are you terminating playback sessions? And, if it’s more than very infrequently, why are you continuing to allow those users to access your server?

this isnt the point at all, i own a server, there shouldnt be a client that ignore whatever the admin do, it doesnt matter if i terminate or not. its not even just termination, it doesnt even pass a sessionid, god knows what other stuff it might be doing?

i think but not confirmed yet, its not even respecting the buffer limit i have, its just ignoring all the rules

I just tested this scenario now, terminating the session does work and PMS will terminate the connection to the client, however the Plezy client will continue playing what it has in its buffer and then just freeze when it runs out of packets.

Once frozen it still continues sending timeline requests so it looks like it’s playing in the Plex dashboard but the video stream was terminated and the user would have to stop the playback session and start it again to get it to work again.

The Plezy client doesn’t appear to have any functionality to understand what is happening here and display the termination message sent by the server.

Feel free to test this yourself but just make sure you’re not testing with the client and server on the same machine as this will bypass these checks.

Hi

it doesnt respect the buffer limit, i have 60s but it can buffer 3 eps in advance somehow
it cant be blocked in taut
it doesnt have sessionid

and no, you cant always terminate it, it does work if its first session for some reason but after you play back to back then “stop session” doesnt even show anymore, and in certain situations but i cant pinpoint them yet

there should be min. requirements to allow clients to access plex api

edit:
i see what you mean, that its not actually playing anymore, i still dont feel comfortable it can appear as it is playing

also why i cant block this client from playing? i can block every other one, so theres something more to this

You are blocking it from playing, the server no longer sends any data to the client after you terminate the session.

The client just doesn’t understand that it should stop the session so it continues sending timeline requests, this must be fixed on the client side.

nope, it is playing normally now even tho im blocking it, i am doing it outside of my network, i can even see taut sending the kill trigger in log, but the client completely ignore it

Which app specifically are you testing with? I used the Mac desktop app and it’s still sitting on a frozen playback screen from my test earlier.

Remember once you restart playback that it’s a new session and you have to terminate it again.

Terminating a session does not block any client from starting a new session, it only stops the one currently playing.

Plezy on Ipad

isnt the fact this app can bypass plex remote restriction is prove in itself tho?

i cannot terminate, not in webui, not in anyway, i am testing it now, impossible to terminate lol

the stop playback dont even show…video clip in a sec