Posters are blank behind a reverse proxy

Blank Radarr and Sonarr posters on a secured, internet-facing install were our bug, fixed in 1.0.0+5. Here is what caused it and how build 7 handles artwork for titles outside your library.

The symptom is oddly specific. Every service connects. Libraries list, the calendar fills, search returns results, downloads report progress. But the Radarr and Sonarr posters are all placeholders, while artwork from Jellyfin, Plex, Emby or Seerr is fine.

This was our bug, and it is fixed in 1.0.0+5. If you are on that version or newer, you should not see it. If you are still seeing blank posters after updating, it is something else - start with Works in a browser, but offline in Kochab.

What we had wrong

Radarr and Sonarr accept your API key on /api/* and nowhere else. Their artwork sits on two other routes:

Both are the web UI’s own routes, behind its session cookie. Kochab was asking for the first one, holding an API key it does not accept - so the *arr answered with its login page and Kochab stored that instead of a poster.

There is an API-authenticated route for the same bytes, /api/v3/mediacover/..., documented in Radarr’s and Sonarr’s own API specifications. Kochab now asks for that. Nothing on your proxy needs changing, and nothing did - we were simply calling the wrong endpoint.

Why it only bit people who secured their setup

Authentication Required defaults to Disabled for Local Addresses, which exempts any request whose source IP is private. A reverse proxy connects from a private address, so that default exempts every request arriving through your proxy too.

Two consequences, and the second is the one worth acting on:

• It hid this bug, because the artwork routes answered without a session.
• *It also leaves your arr open to anything that can reach your proxy.

Set Authentication Required to Enabled if your *arr is reachable from the internet. That is the correct setting, and it no longer costs you your posters.

Posters for titles outside your library

Build 7 does not fetch /MediaCoverProxy/. When a title’s data includes a usable image path and you have Seerr, Kochab uses Seerr’s image proxy. Without Seerr, Kochab can fetch a validated public image URL returned by the service from an allowed image host, such as TMDB or TheTVDB. These direct image requests carry no service credentials.

You do not need Seerr just to see lookup artwork. If the service returns no usable image URL or the selected source fails, Kochab shows a placeholder. Check the connection and share Send Diagnostics from More > Settings > About & Diagnostics if posters stay blank.

Related

• Reverse proxies and remote access
• nginx and SWAG
• Works in a browser, but offline in Kochab