Stremio server URL reported as offline when behind Cloudflare Zero Trust

[pxdeoleo]

I use Cloudflare Zero Trust to protect all of my self-hosted services. Some services require Cloudflare service token headers in order to authenticate when making backend or internal requests.

Observed behavior

I am running Stremio behind Traefik and exposing it via a subdomain (e.g. stremio.example.com). When Cloudflare Zero Trust is not enabled for this subdomain, Stremio works as expected. When Zero Trust is enabled, the behavior is as follows:

1. Accessing https://stremio.example.com redirects to Cloudflare Zero Trust authentication as expected.
2. After authenticating, the Stremio Web UI loads and functions normally.
3. However, can't stream anything, and in Settings > Streaming > URL, the server URL is shown as offline.

Expected behavior

The server URL should remain reachable and reported as online even when the service is protected by Cloudflare Zero Trust, assuming the user has already authenticated.

Deployment details

• Stremio is running in Docker using tsaridas/stremio-docker:latest
• Reverse proxy: Traefik
• TLS termination handled by Traefik
• Cloudflare Zero Trust applied at the subdomain level

This is the compose file I'm using, in case it helps:

services:
  stremio:
    image: tsaridas/stremio-docker:latest
    restart: unless-stopped
    environment:
      NO_CORS: 1
      AUTO_SERVER_URL: 1
      DOMAIN: stremio.example.com
      CERT_FILE: "/root/.stremio-server/cert.pem"
    volumes:
      - "./stremio-data:/root/.stremio-server"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.stremio.rule=Host(`stremio.example.com`)"
      - "traefik.http.routers.stremio.entrypoints=websecure"
      - "traefik.http.routers.stremio.tls=true"
    networks:
      - web

networks:
  web:
    external: true

If there is a recommended way to run Stremio behind an authenticated reverse proxy or Zero Trust-style access control, guidance would be appreciated. Or, at least, any way to add custom headers to the requests.

[tsaridas]

i dont use the features you are mentioning so I wouldn't know. if you make it work you can either create a PR or let me know what exactly is required. I'll keep the ticket open in case someone else is looking at the same issue.

[pxdeoleo]

I believe the issue would be resolved by having the frontend include the CF-Access-Client-Id and CF-Access-Client-Secret headers.

However, I am not seeing an obvious place in the repository where these headers could be added or configured.

For reference, here's the relevant Cloudflare documentation.

[Syked69]

I use this stremio docker setup behind SWAG which is a reverse proxy and it works correctly.

I have the NO_CORS environment variable removed from my docker compose. Not sure if that makes a difference.