I self-host Jellyfin on my homelab and got frustrated opening a laptop every time there was a football match just to deal with popup-infested streaming sites. The actual video underneath is just a standard HLS stream, but getting it into Jellyfin turned out to be harder than expected.
Three problems: (1) the m3u8 URL is buried behind iframes and obfuscated JS, (2) tokens expire every few hours, and (3) the upstream server checks User-Agent and Referer headers on both the playlist and .ts segments — Jellyfin doesn't send these, so you get 403.
I ended up writing three scripts:
- detect-headers.sh: give it a page URL, it follows the iframe chain, extracts the m3u8, then brute-forces header combinations on both .m3u8 and .ts requests. Tells you exactly what the stream needs.
- hls-proxy.py: single-file Python reverse proxy (stdlib only, zero pip dependencies). Injects the required headers and rewrites the m3u8 so segment requests also go through the proxy.
- refresh-m3u.sh: extracts fresh URLs before tokens expire, outputs a Jellyfin-ready M3U with logos and channel groups. Runs on a systemd timer.
~200 lines of Python, ~100 lines of bash. The proxy is the interesting part technically — it has to handle relative and absolute segment URLs, rewrite URI= in EXT tags (for encryption keys), and add CORS headers since Jellyfin's web client makes cross-origin requests.
Happy to answer questions about the approach or implementation.
originalvichy•1h ago
Cool implementation. Never occurred to me Jellyfin could serve as a streaming platform on its own! I’ll probably find the answer after sending this reply (may be helpful to others), but does it come with this functionality out of the box, or is any plug-in needed?
How probable is it that this kind of method can be patched or obfuscated further? I assume that since the HLS stream is always at the core, it’s a matter of just finding alternative ways to dig through it.
Any quirks this implementation has wrt. things like quality or additional delay? Thanks! I’d like to try out if your methods could be used to make some sort of snippet that could be sent to VLC that’s running on a TV or streaming device.
gibsonsmog•31m ago
I'm curious if there is a particular technical reason you chose to make this as a separate script rather than some kind of Jellyfin plugin? I actually appreciate that you did it in this fashion (more useful for me personally), just curious if there were limitations within the Jellyfin/dotNet system.
Either way, gonna make my World Cup viewing experience this year a lot easier haha
dchuk•41m ago
Very cool. I’ve used a paid service for years now that gets me all sorts of sports and channels very reliably, I would assume they’re doing something similar to make this work. Might try this though with my home server setup.
Think it could be ran from within a docker container so I could add it to an existing docker compose media server setup?
theappsecguy•22m ago
any chance you'd be willing to share what the service is? I use streameast all the time but it's not reliable enough
pruz•3h ago
Three problems: (1) the m3u8 URL is buried behind iframes and obfuscated JS, (2) tokens expire every few hours, and (3) the upstream server checks User-Agent and Referer headers on both the playlist and .ts segments — Jellyfin doesn't send these, so you get 403.
I ended up writing three scripts:
- detect-headers.sh: give it a page URL, it follows the iframe chain, extracts the m3u8, then brute-forces header combinations on both .m3u8 and .ts requests. Tells you exactly what the stream needs.
- hls-proxy.py: single-file Python reverse proxy (stdlib only, zero pip dependencies). Injects the required headers and rewrites the m3u8 so segment requests also go through the proxy.
- refresh-m3u.sh: extracts fresh URLs before tokens expire, outputs a Jellyfin-ready M3U with logos and channel groups. Runs on a systemd timer.
~200 lines of Python, ~100 lines of bash. The proxy is the interesting part technically — it has to handle relative and absolute segment URLs, rewrite URI= in EXT tags (for encryption keys), and add CORS headers since Jellyfin's web client makes cross-origin requests.
Happy to answer questions about the approach or implementation.
originalvichy•1h ago
How probable is it that this kind of method can be patched or obfuscated further? I assume that since the HLS stream is always at the core, it’s a matter of just finding alternative ways to dig through it.
Any quirks this implementation has wrt. things like quality or additional delay? Thanks! I’d like to try out if your methods could be used to make some sort of snippet that could be sent to VLC that’s running on a TV or streaming device.
gibsonsmog•31m ago
Either way, gonna make my World Cup viewing experience this year a lot easier haha