search

onvif / specs

ONVIF Network Interface Specifications
Other
345 stars 93 forks source link

WebRTC: Use Authorization header as standard authentication #397

Closed jmelancongen closed 5 months ago

jmelancongen commented 9 months ago

Currently, the signaling protocol specifies initial authentication as a mandatory register message when opening the websocket. This forces a signaling server to accept unauthenticated websockets and leave them open for some time to receive the actual authentication information which open us to some DoS/resource exhaustion attacks.

Since we have a precedent in the Uplink specification of authenticating a WebSocket connection via the header or query parameter (to accomodate browser websockets, which can't provide headers). This ensures we use a common way of authenticating these kind of cloud connections in both specs, and allow us to validate that the request is legitimate before accepting any websocket session.

jmelancongen commented 8 months ago

Updated to only add the Authorization header requirement, without removing the register command as discussed during F2F review