From 196c243a7d53d06a5fe492942442d48bba9727c4 Mon Sep 17 00:00:00 2001
From: Niels van Velzen <git@ndat.nl>
Date: Tue, 18 Nov 2025 16:13:48 +0100
Subject: [PATCH 1/2] Disable legacy authorization methods by default

---
 .../Routines/DisableLegacyAuthorization.cs    | 30 +++++++++++++++++++
 .../Configuration/ServerConfiguration.cs      |  2 +-
 2 files changed, 31 insertions(+), 1 deletion(-)
 create mode 100644 Jellyfin.Server/Migrations/Routines/DisableLegacyAuthorization.cs

diff --git a/Jellyfin.Server/Migrations/Routines/DisableLegacyAuthorization.cs b/Jellyfin.Server/Migrations/Routines/DisableLegacyAuthorization.cs
new file mode 100644
index 0000000000..8bfb0c4e8e
--- /dev/null
+++ b/Jellyfin.Server/Migrations/Routines/DisableLegacyAuthorization.cs
@@ -0,0 +1,30 @@
+using MediaBrowser.Controller.Configuration;
+
+namespace Jellyfin.Server.Migrations.Routines;
+
+/// <summary>
+/// Migration to disable legacy authorization in the system config.
+/// </summary>
+#pragma warning disable CS0618 // Type or member is obsolete
+[JellyfinMigration("2025-11-18T16:00:00", nameof(DisableLegacyAuthorization), "F020F843-E079-4061-99E0-F43D145F2557")]
+public class DisableLegacyAuthorization : IMigrationRoutine
+#pragma warning restore CS0618 // Type or member is obsolete
+{
+    private readonly IServerConfigurationManager _serverConfigurationManager;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="DisableLegacyAuthorization"/> class.
+    /// </summary>
+    /// <param name="serverConfigurationManager">Instance of the <see cref="IServerConfigurationManager"/> interface.</param>
+    public DisableLegacyAuthorization(IServerConfigurationManager serverConfigurationManager)
+    {
+        _serverConfigurationManager = serverConfigurationManager;
+    }
+
+    /// <inheritdoc />
+    public void Perform()
+    {
+        _serverConfigurationManager.Configuration.EnableLegacyAuthorization = false;
+        _serverConfigurationManager.SaveConfiguration();
+    }
+}
diff --git a/MediaBrowser.Model/Configuration/ServerConfiguration.cs b/MediaBrowser.Model/Configuration/ServerConfiguration.cs
index a58c01c960..ac5c12304e 100644
--- a/MediaBrowser.Model/Configuration/ServerConfiguration.cs
+++ b/MediaBrowser.Model/Configuration/ServerConfiguration.cs
@@ -287,5 +287,5 @@ public class ServerConfiguration : BaseApplicationConfiguration
     /// <summary>
     /// Gets or sets a value indicating whether old authorization methods are allowed.
     /// </summary>
-    public bool EnableLegacyAuthorization { get; set; } = true;
+    public bool EnableLegacyAuthorization { get; set; }
 }

From 67c67df5077af5c90242fc5fc36373b2ae6f2c91 Mon Sep 17 00:00:00 2001
From: Niels van Velzen <git@ndat.nl>
Date: Thu, 20 Nov 2025 22:11:55 +0100
Subject: [PATCH 2/2] Use async migration

---
 .../Routines/DisableLegacyAuthorization.cs           | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/Jellyfin.Server/Migrations/Routines/DisableLegacyAuthorization.cs b/Jellyfin.Server/Migrations/Routines/DisableLegacyAuthorization.cs
index 8bfb0c4e8e..6edfcbcfd5 100644
--- a/Jellyfin.Server/Migrations/Routines/DisableLegacyAuthorization.cs
+++ b/Jellyfin.Server/Migrations/Routines/DisableLegacyAuthorization.cs
@@ -1,3 +1,5 @@
+using System.Threading;
+using System.Threading.Tasks;
 using MediaBrowser.Controller.Configuration;
 
 namespace Jellyfin.Server.Migrations.Routines;
@@ -5,10 +7,8 @@ namespace Jellyfin.Server.Migrations.Routines;
 /// <summary>
 /// Migration to disable legacy authorization in the system config.
 /// </summary>
-#pragma warning disable CS0618 // Type or member is obsolete
-[JellyfinMigration("2025-11-18T16:00:00", nameof(DisableLegacyAuthorization), "F020F843-E079-4061-99E0-F43D145F2557")]
-public class DisableLegacyAuthorization : IMigrationRoutine
-#pragma warning restore CS0618 // Type or member is obsolete
+[JellyfinMigration("2025-11-18T16:00:00", nameof(DisableLegacyAuthorization))]
+public class DisableLegacyAuthorization : IAsyncMigrationRoutine
 {
     private readonly IServerConfigurationManager _serverConfigurationManager;
 
@@ -22,9 +22,11 @@ public class DisableLegacyAuthorization : IMigrationRoutine
     }
 
     /// <inheritdoc />
-    public void Perform()
+    public Task PerformAsync(CancellationToken cancellationToken)
     {
         _serverConfigurationManager.Configuration.EnableLegacyAuthorization = false;
         _serverConfigurationManager.SaveConfiguration();
+
+        return Task.CompletedTask;
     }
 }