Add require_login and require_login_for_embeds config options - #5795
Add require_login and require_login_for_embeds config options#5795Geekshere wants to merge 3 commits into
Conversation
|
Did you use AI to make this PR? If so, please note it. The AI_POLICY.md file is still not merged (https://github.com/iv-org/invidious/pull/5791/changes) but it says:
Just asking because the summary looks very AI made-ish. |
|
For the record there has already been a PR opened here: #3728 |
|
Ah yes sorry I apologize, I did use AI for some assistance as I am not fully familiar with crystal. I am not a big fan of it but regardless it is helpful. I used Claude Sonnet 4.6 and I did thoroughly test the changes. I did not use Claude code I used the website and just used it for some clarification and assistance (and the summary as you can tell). |
I don't know how I missed that, sorry. It seems to be stale, though, I don't mind closing this in favor of it. |
3 participants
Related to #446
Summary
Adds two new boolean config options:
require_login- when enabled, unauthenticated users are redirected to/loginwhen accessing any page on the instancerequire_login_for_embeds- when enabled alongsiderequire_login,also restricts
/embed/routes (default: false, so embeds remainaccessible on external sites by default)
Use case
This is useful for private instances where the owner wants to restrict access to approved users only e.g. a family server
What's exempted from the redirect
Even with
require_login: true, the following are always accessible without login to avoid breaking functionality:/login,/register/api/(API routes)/embed/(unlessrequire_login_for_embeds: true)/vi/,/sb/,/ggpht/,/yts/,/s_p/(thumbnails/assets)/videoplayback,/latest_version,/download,/companion/Configuration
In
config.yml:
require_login: true
require_login_for_embeds: true # optional, defaults to false Note
Due to third-party cookie restrictions in modern browsers, enabling
require_login_for_embedswill effectively disable embedding on external sites even for authenticated users. Only useful if embeds are served on the same domain as the instance.