suggest using JWTs in query parameters for RTSP and RTMP (#5267) (#5493)

In case of RTSP and RTMP, JWTs cannot be used as passwords since
there's a size limit. Therefore, documentation is updated to suggest
passing JWT through query parameters, and authJWTInHTTPQuery is updated
to act on HTTP requests only.

docs/2-usage/05-authentication.md

@@ -299,23 +299,23 @@ Authorization: Bearer username:password
 
 ### RTSP
 
-Pass the token as password, with an arbitrary user:
+Pass the token as query parameter:
 
 ```
-rtsp://user:jwt@localhost:8554/mystream
+rtsp://localhost:8554/mystream?jwt=jwt
 ```
 
-WARNING: FFmpeg implementation of RTSP does not support passwords that are longer than 1024 characters, therefore you have to configure your identity server in order to produce JWTs that are shorter than this threshold.
+WARNING: FFmpeg implementation of RTSP does not support URLs that are longer than 4096 characters (this is the [MAX_URL_SIZE constant](https://github.com/FFmpeg/FFmpeg/blob/f951aa9ef382d6bb517e05d04d52710f751de427/libavformat/internal.h#L30)), therefore you have to configure your identity server in order to produce JWTs that are shorter than this threshold.
 
 ### RTMP
 
-Pass the token as password, with an arbitrary user:
+Pass the token as query parameter:
 
 ```
-rtmp://localhost/mystream?user=user&pass=jwt
+rtmp://localhost/mystream?jwt=jwt
 ```
 
-WARNING: FFmpeg implementation of RTMP does not support passwords and query parameters that are longer than 1024 characters, therefore you have to configure your identity server in order to produce JWTs that are shorter than this threshold.
+WARNING: FFmpeg implementation of RTMP does not support query parameters that are longer than 1024 characters, therefore you have to configure your identity server in order to produce JWTs that are shorter than this threshold.
 
 ### SRT
 
@@ -339,4 +339,4 @@ In OBS Studio, this is the "Bearer Token" field.
 
 If the `Authorization: Bearer` token cannot be directly provided (for instance, with web browsers that directly access _MediaMTX_ and show a credential dialog), you can pass the token as password, using an arbitrary user.
 
-In web browsers, if you need to automatically fill credentials from a parent web page, see [Embed streams in a website](embed-streams-in-a-website).
+In web browsers, if you need to automatically fill credentials from a parent web page, read [Embed streams in a website](embed-streams-in-a-website).

internal/auth/manager.go

@@ -27,6 +27,14 @@ const (
 	jwksRefreshPeriod = 60 * 60 * time.Second
 )
 
+func isHTTP(req *Request) bool {
+	return req.Protocol == ProtocolHLS || req.Protocol == ProtocolWebRTC ||
+		req.Action == conf.AuthActionPlayback ||
+		req.Action == conf.AuthActionAPI ||
+		req.Action == conf.AuthActionMetrics ||
+		req.Action == conf.AuthActionPprof
+}
+
 func matchesPermission(perms []conf.AuthInternalUserPermission, req *Request) bool {
 	for _, perm := range perms {
 		if perm.Action == req.Action {
@@ -224,7 +232,8 @@ func (m *Manager) authenticateJWT(req *Request) error {
 	case req.Credentials.Pass != "":
 		encodedJWT = req.Credentials.Pass
 
-	case m.JWTInHTTPQuery:
+		// always allow passing JWT through query parameters with RTSP and RTMP since there's no alternative.
+	case req.Protocol == ProtocolRTSP || req.Protocol == ProtocolRTMP || (isHTTP(req) && m.JWTInHTTPQuery):
 		var v url.Values
 		v, err = url.ParseQuery(req.Query)
 		if err != nil {

mediamtx.yml

@@ -148,7 +148,7 @@ authJWTClaimKey: mediamtx_permissions
 # Format is the same as the one of user permissions.
 authJWTExclude: []
 # allow passing the JWT through query parameters of HTTP requests (i.e. ?jwt=JWT).
-# This is a security risk and will be disabled by default in the future.
+# This is a security risk and will be disabled in the future.
 authJWTInHTTPQuery: true
 
 ###############################################