RestComm / restcomm-web-sdk

RestComm WebRTC JavaScript SDK
http://www.restcomm.com/
GNU Affero General Public License v3.0
13 stars 32 forks source link

Insecure SIP registration #116

Open ajamous opened 6 years ago

ajamous commented 6 years ago

There are some clients that would use the same sip username and password to send calls out from a single application that many users use.

In such a case, sending sip username and password to the server in clear text is not a good idea and very insecure which may cause the app developer to be a victim of unauthorized calls/charges.

To avoid this issue, the sip password can travel in MD5 hash over the network and decrypts on the server side to check it it matches or not.