Accessing PVE without login page

[Eduardrift]

I'm trying to display a VM console on a smart television, but the TV is old and doesn't really work very well. The login page does not load correctly, so it is impossible to log in. It is actually possible to load the VM console though, the only thing I need is authentication. So I wanted to know if it's possible to generate a link from an already logged in account, with the necessary cookies, to send to the television in order to skip the login page and jump directly into the console.

 

[Hannes Laimer]

Hey,

if you can set cookies on your TV that should work, but there is a good chance that on an old TV the browser might cause other things not to work properly. Setting the PVEAuthCookie cookie on your TV should do it. Clicking Console > noVCN should open a new window you can copy the URL of that and use it on the TV. So something like
1. open URL on TV
2. set PVEAuthCookie cookie
3. reload

 

[Eduardrift]

Hey, I figured that was a possible solution and I've been trying all day yesterday and today, but I haven't figured out any way to set a cookie. The tv runs on an old android operating system and they make it kind of hard to do those things. If i can't figure out a way to set cookies I'll probably settle for buying a chromecast or something like that. Thanks for the reply though!

 

[Eduardrift]

So I was able to solve the problem, and I'll leave my solution here for any other old Philco TV users out there. In order to set the cookie on an Android you need the Cookie Editor Chrome extension, which is only available on a handful of mobile browsers (like Kiwi, Yandex or Firefox), which are actually only compatible with Android 5.0+. Since this TV is an Android 4.4, the only browser I could find that was compatible with extensions was Optima browser. After that I just had to download a keyboard with a clipboard (I used Swiftkey), since it's a pain to type in an entire cookie value by hand. After setting the cookie, I just accessed the VM URL directly and was able to display it.

 

[Dunuin]

The big question is if an Android 4.4 device, which didn't got any security patches for 9 years fixing very bad security risks, should be allowed to go online in 2022 and be part of a LAN with devices storing sensible data.
I personally would atleast put that TV in a separated network with no access to any other machine and then accessing the PVe webUI wouldn't be possible anyway. Or atleast only if that PVE webUi is available online and even then I wouldn't use it, as then the unsecure Android got admin access to all your VMs/LXCs. Or atleast in case you didn't create a unprivileged PVE realm user just for that TV.

But thanks that you shared your solution in case someone else wants to do the same.

 

[Eduardrift]

That's a good question, I'll look into the security issues, thanks!