3 files changed, 34 insertions, 24 deletions
diff --git a/MediaBrowser.Model/Configuration/ServerConfiguration.cs b/MediaBrowser.Model/Configuration/ServerConfiguration.cs
index a58c01c96..ac5c12304 100644
--- a/MediaBrowser.Model/Configuration/ServerConfiguration.cs
+++ b/MediaBrowser.Model/Configuration/ServerConfiguration.cs
@@ -287,5 +287,5 @@ public class ServerConfiguration : BaseApplicationConfiguration
     /// <summary>
     /// Gets or sets a value indicating whether old authorization methods are allowed.
     /// </summary>
-    public bool EnableLegacyAuthorization { get; set; } = true;
+    public bool EnableLegacyAuthorization { get; set; }
 }
diff --git a/MediaBrowser.Model/Dlna/StreamInfo.cs b/MediaBrowser.Model/Dlna/StreamInfo.cs
index 13acd15a3..92404de50 100644
--- a/MediaBrowser.Model/Dlna/StreamInfo.cs
+++ b/MediaBrowser.Model/Dlna/StreamInfo.cs
@@ -1250,30 +1250,37 @@ public class StreamInfo
 
         if (info.DeliveryMethod == SubtitleDeliveryMethod.External)
         {
-            if (MediaSource.Protocol == MediaProtocol.File || !string.Equals(stream.Codec, subtitleProfile.Format, StringComparison.OrdinalIgnoreCase) || !stream.IsExternal)
-            {
-                info.Url = string.Format(
-                    CultureInfo.InvariantCulture,
-                    "{0}/Videos/{1}/{2}/Subtitles/{3}/{4}/Stream.{5}",
-                    baseUrl,
-                    ItemId,
-                    MediaSourceId,
-                    stream.Index.ToString(CultureInfo.InvariantCulture),
-                    startPositionTicks.ToString(CultureInfo.InvariantCulture),
-                    subtitleProfile.Format);
-
-                if (!string.IsNullOrEmpty(accessToken))
-                {
-                    info.Url += "?ApiKey=" + accessToken;
-                }
-
-                info.IsExternalUrl = false;
-            }
-            else
+            // Default to using the API URL
+            info.Url = string.Format(
+                CultureInfo.InvariantCulture,
+                "{0}/Videos/{1}/{2}/Subtitles/{3}/{4}/Stream.{5}",
+                baseUrl,
+                ItemId,
+                MediaSourceId,
+                stream.Index.ToString(CultureInfo.InvariantCulture),
+                startPositionTicks.ToString(CultureInfo.InvariantCulture),
+                subtitleProfile.Format);
+            info.IsExternalUrl = false; // Default to API URL
+
+            // Check conditions for potentially using the direct path
+            if (stream.IsExternal // Must be external
+                && MediaSource?.Protocol != MediaProtocol.File // Main media must not be a local file
+                && string.Equals(stream.Codec, subtitleProfile.Format, StringComparison.OrdinalIgnoreCase) // Format must match (no conversion needed)
+                && !string.IsNullOrEmpty(stream.Path) // Path must exist
+                && Uri.TryCreate(stream.Path, UriKind.Absolute, out Uri? uriResult) // Path must be an absolute URI
+                && (uriResult.Scheme == Uri.UriSchemeHttp || uriResult.Scheme == Uri.UriSchemeHttps)) // Scheme must be HTTP or HTTPS
             {
+                // All conditions met, override with the direct path
                 info.Url = stream.Path;
                 info.IsExternalUrl = true;
             }
+
+            // Append ApiKey only if we are using the API URL
+            if (!info.IsExternalUrl && !string.IsNullOrEmpty(accessToken))
+            {
+                // Use "?ApiKey=" as seen in HEAD and other parts of the code
+                info.Url += "?ApiKey=" + accessToken;
+            }
         }
 
         return info;
diff --git a/MediaBrowser.Model/Dto/UserDto.cs b/MediaBrowser.Model/Dto/UserDto.cs
index 05019741e..c6b4a4d14 100644
--- a/MediaBrowser.Model/Dto/UserDto.cs
+++ b/MediaBrowser.Model/Dto/UserDto.cs
@@ -1,5 +1,6 @@
 #nullable disable
 using System;
+using System.ComponentModel;
 using MediaBrowser.Model.Configuration;
 using MediaBrowser.Model.Users;
 
@@ -54,20 +55,22 @@ namespace MediaBrowser.Model.Dto
         /// Gets or sets a value indicating whether this instance has password.
         /// </summary>
         /// <value><c>true</c> if this instance has password; otherwise, <c>false</c>.</value>
-        public bool HasPassword { get; set; }
+        [Obsolete("This information is no longer provided")]
+        public bool? HasPassword { get; set; } = true;
 
         /// <summary>
         /// Gets or sets a value indicating whether this instance has configured password.
         /// </summary>
         /// <value><c>true</c> if this instance has configured password; otherwise, <c>false</c>.</value>
-        public bool HasConfiguredPassword { get; set; }
+        [Obsolete("This is always true")]
+        public bool? HasConfiguredPassword { get; set; } = true;
 
         /// <summary>
         /// Gets or sets a value indicating whether this instance has configured easy password.
         /// </summary>
         /// <value><c>true</c> if this instance has configured easy password; otherwise, <c>false</c>.</value>
         [Obsolete("Easy Password has been replaced with Quick Connect")]
-        public bool HasConfiguredEasyPassword { get; set; }
+        public bool? HasConfiguredEasyPassword { get; set; } = false;
 
         /// <summary>
         /// Gets or sets whether async login is enabled or not.