YTMD/youtube-music

Fork 0

HTTPS Support & Custom Certificates #3647

New issue

Open

opened 2025-07-19 03:57:16 +00:00 by nglmercer · 3 comments

nglmercer commented

2025-07-19 03:57:16 +00:00

(Migrated from github.com)

Preflight Checklist

I use the latest version of YouTube Music (Application).
I have searched the issue tracker for a feature request that matches the one I want to file, without success.

Problem Description

🚀 Feature Request: HTTPS Support & Custom Certificates

I built a web page that works as a remote control for the app via the REST API.
Right now, it only accepts local origins (127.0.0.1, localhost) or plain HTTP traffic.

Proposed Solution

Request:
Please add an option for users to upload their own certificates (.pem, .crt) and enable HTTPS connections.
This would allow:

Secure connections to devices on other networks.
End-to-end data integrity and confidentiality.
(referencing https://github.com/nglmercer/yt-music-swg)

Thank you!

Alternatives Considered

add documentation to the REST API

Additional Information

No response

### Preflight Checklist - [x] I use the latest version of YouTube Music (Application). - [x] I have searched the [issue tracker](https://github.com/th-ch/youtube-music/issues) for a feature request that matches the one I want to file, without success. ### Problem Description ### 🚀 Feature Request: HTTPS Support & Custom Certificates I built a web page that works as a remote control for the app via the REST API. Right now, it only accepts local origins (`127.0.0.1`, `localhost`) or plain HTTP traffic. ### Proposed Solution **Request:** Please add an option for users to upload their own certificates (`.pem`, `.crt`) and enable **HTTPS** connections. This would allow: - Secure connections to devices on other networks. - End-to-end data integrity and confidentiality. (referencing https://github.com/nglmercer/yt-music-swg) <img width="1872" height="997" alt="Image" src="https://github.com/user-attachments/assets/2127ff99-2373-4f1f-9ec6-47ef47553a0b" /> Thank you! ### Alternatives Considered add documentation to the REST API ### Additional Information _No response_

mohanad-80 commented

2025-09-09 19:27:31 +00:00

(Migrated from github.com)

@JellyBrick tagging you since you labeled this issue. Please let me know if you have any input or if someone else is already working on it!

Hi there, I’m interested in working on this issue and have already started prototyping a solution on a separate branch. Is anyone else currently working on this, or is it okay for me to proceed and open a PR when ready? If there are any specific requirements or preferences for implementation, please let me know. Thanks! @JellyBrick tagging you since you labeled this issue. Please let me know if you have any input or if someone else is already working on it!

nglmercer commented

2025-09-09 21:06:07 +00:00

(Migrated from github.com)

I use a proxy on my PC and redirect requests, obviously using an SSL certificate to have the https server and for everything to work correctly.

5️⃣ Dynamic Reverse Proxy

Activation: send the header X-Proxy-Target: <absolute url> in any request to the server.

Additional header	Purpose
`X-Proxy-Timeout`	Max time in ms (default `30000`).
`Proxy-Authorization`	Basic credentials that are re-sent as `Authorization`.

Example:

curl -H "X-Proxy-Target: https://jsonplaceholder.typicode.com/todos/1" \
     -H "Proxy-Authorization: Basic dXNlcjpwYXNz" \
     http://localhost:3001/anything

code sample

import { Hono } from 'hono'

const app = new Hono()

app.all('*', async (c) => {
  const target = c.req.header('X-Proxy-Target')
  
  if (!target) {
    return c.text('Missing X-Proxy-Target header', 400)
  }

  try {
    const timeout = parseInt(c.req.header('X-Proxy-Timeout') || '30000')
    const auth = c.req.header('Proxy-Authorization')
    
    // Copy headers
    const headers = new Headers(c.req.raw.headers)
    headers.delete('X-Proxy-Target')
    headers.delete('X-Proxy-Timeout')
    
    if (auth) {
      headers.set('Authorization', auth)
      headers.delete('Proxy-Authorization')
    }

    // Forward request
    const controller = new AbortController()
    setTimeout(() => controller.abort(), timeout)
    
    const response = await fetch(target, {
      method: c.req.method,
      headers,
      body: c.req.method !== 'GET' ? await c.req.arrayBuffer() : undefined,
      signal: controller.signal
    })

    return new Response(await response.arrayBuffer(), {
      status: response.status,
      headers: response.headers
    })
    
  } catch (err) {
    return c.text(`Proxy error: ${err}`, 500)
  }
})

export default app

I would like to know how an implementation could be done, since the proxy is only an option, not the solution.

I use a proxy on my PC and redirect requests, obviously using an SSL certificate to have the https server and for everything to work correctly. ### 5️⃣ Dynamic Reverse Proxy **Activation**: send the header `X-Proxy-Target: <absolute url>` in any request to the server. | Additional header | Purpose | |-----------------------|-----------------------------------------------------------| | `X-Proxy-Timeout` | Max time in ms (default `30000`). | | `Proxy-Authorization` | Basic credentials that are re-sent as `Authorization`. | Example: ```bash curl -H "X-Proxy-Target: https://jsonplaceholder.typicode.com/todos/1" \ -H "Proxy-Authorization: Basic dXNlcjpwYXNz" \ http://localhost:3001/anything ``` code sample ```typescript import { Hono } from 'hono' const app = new Hono() app.all('*', async (c) => { const target = c.req.header('X-Proxy-Target') if (!target) { return c.text('Missing X-Proxy-Target header', 400) } try { const timeout = parseInt(c.req.header('X-Proxy-Timeout') || '30000') const auth = c.req.header('Proxy-Authorization') // Copy headers const headers = new Headers(c.req.raw.headers) headers.delete('X-Proxy-Target') headers.delete('X-Proxy-Timeout') if (auth) { headers.set('Authorization', auth) headers.delete('Proxy-Authorization') } // Forward request const controller = new AbortController() setTimeout(() => controller.abort(), timeout) const response = await fetch(target, { method: c.req.method, headers, body: c.req.method !== 'GET' ? await c.req.arrayBuffer() : undefined, signal: controller.signal }) return new Response(await response.arrayBuffer(), { status: response.status, headers: response.headers }) } catch (err) { return c.text(`Proxy error: ${err}`, 500) } }) export default app ``` I would like to know how an implementation could be done, since the proxy is only an option, not the solution.

mohanad-80 commented

2025-09-09 21:48:18 +00:00

(Migrated from github.com)

I would like to know how an implementation could be done, since the proxy is only an option, not the solution.

The solution I'm working on is to add an option in the api-server plugin for enabling HTTPS on the server and allowing the user to specify the paths of the certificate and key files to be used on the server.

When this option is enabled by the user, the plugin will restart and then it will create a secure server and pass the certificate and key files to Hono's serve method to create a server that can be connected to using HTTPS.

I just wanted to check here if anyone else is working on this issue before I open a PR with the code I wrote.

> I would like to know how an implementation could be done, since the proxy is only an option, not the solution. The solution I'm working on is to add an option in the api-server plugin for enabling HTTPS on the server and allowing the user to specify the paths of the certificate and key files to be used on the server. When this option is enabled by the user, the plugin will restart and then it will create a secure server and pass the certificate and key files to Hono's `serve` method to create a server that can be connected to using HTTPS. I just wanted to check here if anyone else is working on this issue before I open a PR with the code I wrote.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: YTMD/youtube-music#3647

No description provided.

Rows
Columns