search

meetecho / janus-gateway

Janus WebRTC Server
https://janus.conf.meetecho.com
GNU General Public License v3.0
8.17k stars 2.47k forks source link

[1.x] HMAC-Signed token authentication works with janus.plugin.streaming #3318

Closed kharkhutam closed 8 months ago

kharkhutam commented 8 months ago

What version of Janus is this happening on? v1.2.2

Have you tested a more recent version of Janus too? Yes, it was tested on the latest sources (commit-hash: 15ef4d6cde38ea8d441f7e27eba298265c2a7358.

Was this working before? No information.

Is there a gdb or libasan trace of the issue? No.

Additional context Hi Meetecho team! I am interested in using an authentication for a streaming client. Following the documentation, I tried the Stored token based authentication mechanism, but I also tried HMAC-Signed token authentication, as that approach would be more appropriate in my case, and it worked as well. Is this a bug? Or can rely on it? More information is provided below. Thanks in advance!

Server info:

{
    "janus": "server_info",
    "transaction": "PFhshR9bnxL",
    "name": "Janus WebRTC Server",
    "version": 1202,
    "version_string": "1.2.2",
    "author": "Meetecho s.r.l.",
    "commit-hash": "15ef4d6cde38ea8d441f7e27eba298265c2a7358",
    "compile-time": "Fri Jan  5 04:39:38 PM EET 2024",
    "log-to-stdout": true,
    "log-to-file": false,
    "data_channels": true,
    "accepting-new-sessions": true,
    "session-timeout": 60,
    "reclaim-session-timeout": 0,
    "candidates-timeout": 45,
    "server-name": "MyJanusInstance",
    "local-ip": "local-ip",
    "ipv6": false,
    "ice-lite": false,
    "ice-tcp": false,
    "ice-nomination": "aggressive",
    "ice-consent-freshness": false,
    "ice-keepalive-conncheck": false,
    "hangup-on-failed": false,
    "full-trickle": false,
    "mdns-enabled": true,
    "min-nack-queue": 200,
    "nack-optimizations": false,
    "twcc-period": 200,
    "dtls-mtu": 1200,
    "static-event-loops": 0,
    "api_secret": false,
    "auth_token": true,
    "event_handlers": false,
    "opaqueid_in_api": false,
    "dependencies": {
        "glib2": "2.78.0",
        "jansson": "2.14",
        "libnice": "0.1.18.1",
        "libsrtp": "libsrtp2 2.5.0",
        "libcurl": "8.2.1",
        "crypto": "OpenSSL 3.0.10 1 Aug 2023"
    },
    "transports": {
        "janus.transport.http": {
            "name": "JANUS REST (HTTP/HTTPS) transport plugin",
            "author": "Meetecho s.r.l.",
            "description": "This transport plugin adds REST (HTTP/HTTPS) support to the Janus API via libmicrohttpd.",
            "version_string": "0.0.2",
            "version": 2
        },
        "janus.transport.websockets": {
            "name": "JANUS WebSockets transport plugin",
            "author": "Meetecho s.r.l.",
            "description": "This transport plugin adds WebSockets support to the Janus API via libwebsockets.",
            "version_string": "0.0.1",
            "version": 1
        }
    },
    "events": {},
    "loggers": {},
    "plugins": {
        "janus.plugin.audiobridge": {
            "name": "JANUS AudioBridge plugin",
            "author": "Meetecho s.r.l.",
            "description": "This is a plugin implementing an audio conference bridge for Janus, mixing Opus streams.",
            "version_string": "0.0.12",
            "version": 12
        },
        "janus.plugin.recordplay": {
            "name": "JANUS Record&Play plugin",
            "author": "Meetecho s.r.l.",
            "description": "This is a trivial Record&Play plugin for Janus, to record WebRTC sessions and replay them.",
            "version_string": "0.0.4",
            "version": 4
        },
        "janus.plugin.textroom": {
            "name": "JANUS TextRoom plugin",
            "author": "Meetecho s.r.l.",
            "description": "This is a plugin implementing a text-only room for Janus, using DataChannels.",
            "version_string": "0.0.2",
            "version": 2
        },
        "janus.plugin.nosip": {
            "name": "JANUS NoSIP plugin",
            "author": "Meetecho s.r.l.",
            "description": "This is a simple RTP bridging plugin that leaves signalling details (e.g., SIP) up to the application.",
            "version_string": "0.0.1",
            "version": 1
        },
        "janus.plugin.sip": {
            "name": "JANUS SIP plugin",
            "author": "Meetecho s.r.l.",
            "description": "This is a simple SIP plugin for Janus, allowing WebRTC peers to register at a SIP server and call SIP user agents through a Janus instance.",
            "version_string": "0.0.8",
            "version": 8
        },
        "janus.plugin.videocall": {
            "name": "JANUS VideoCall plugin",
            "author": "Meetecho s.r.l.",
            "description": "This is a simple video call plugin for Janus, allowing two WebRTC peers to call each other through a server.",
            "version_string": "0.0.6",
            "version": 6
        },
        "janus.plugin.streaming": {
            "name": "JANUS Streaming plugin",
            "author": "Meetecho s.r.l.",
            "description": "This is a streaming plugin for Janus, allowing WebRTC peers to watch/listen to pre-recorded files or media generated by an external source.",
            "version_string": "0.0.10",
            "version": 10
        },
        "janus.plugin.echotest": {
            "name": "JANUS EchoTest plugin",
            "author": "Meetecho s.r.l.",
            "description": "This is a trivial EchoTest plugin for Janus, just used to showcase the plugin interface.",
            "version_string": "0.0.7",
            "version": 7
        }
    }
}

The communication channel is Web Socket. The token was generated using the code sample 1. Message

{
    "janus": "create",
    "transaction": "O1TX547SwV0s"
}

Response

{
    "janus": "error",
    "transaction": "O1TX547SwV0s",
    "error": {
        "code": 403,
        "reason": "Unauthorized request (wrong or missing secret/token)"
    }
}

Message

{
    "janus": "create",
    "transaction": "O1TX547SwV0s",
    "token": "1704812522,janus,janus.plugin.streaming:/R5iPzniOhUAevzwEUW04P5anck="
}

Response

{
    "janus": "success",
    "transaction": "O1TX547SwV0s",
    "data": {
        "id": 7365935784475845
    }
}

2. Message

{
    "janus": "attach",
    "plugin": "janus.plugin.streaming",
    "transaction": "BtXVh3hDBpfP",
    "session_id": 7365935784475845
}

Response

{
    "janus": "error",
    "session_id": 7365935784475845,
    "transaction": "BtXVh3hDBpfP",
    "error": {
        "code": 403,
        "reason": "Unauthorized request (wrong or missing secret/token)"
    }
}

Message

{
    "janus": "attach",
    "plugin": "janus.plugin.streaming",
    "transaction": "BtXVh3hDBpfP",
    "session_id": 7365935784475845,
    "token": "1704812522,janus,janus.plugin.streaming:/R5iPzniOhUAevzwEUW04P5anck="
}

Response

{
    "janus": "success",
    "session_id": 7365935784475845,
    "transaction": "BtXVh3hDBpfP",
    "data": {
        "id": 6671518912232483
    }
}

3. Message

{
    "janus": "message",
    "body": {
        "request": "watch",
        "id": 102
    },
    "transaction": "tHSxBpG2CPxC",
    "session_id": 7365935784475845,
    "handle_id": 6671518912232483
}

Response

{
    "janus": "error",
    "session_id": 7365935784475845,
    "transaction": "tHSxBpG2CPxC",
    "error": {
        "code": 403,
        "reason": "Unauthorized request (wrong or missing secret/token)"
    }
}

Message

{
    "janus": "message",
    "body": {
        "request": "watch",
        "id": 102
    },
    "transaction": "tHSxBpG2CPxC",
    "session_id": 7365935784475845,
    "handle_id": 6671518912232483,
    "token": "1704812522,janus,janus.plugin.streaming:/R5iPzniOhUAevzwEUW04P5anck="
}

Response

{
    "janus": "ack",
    "session_id": 7365935784475845,
    "transaction": "tHSxBpG2CPxC"
}
{
    "janus": "event",
    "session_id": 7365935784475845,
    "transaction": "tHSxBpG2CPxC",
    "sender": 6671518912232483,
    "plugindata": {
        "plugin": "janus.plugin.streaming",
        "data": {
            "streaming": "event",
            "error_code": 455,
            "error": "No such mountpoint/stream 102"
        }
    }
}
lminiero commented 8 months ago

Already answered on the group (even though I can't find the topic anymore?). Closing.