When clients connect with some protocols (SRT, RTMP), they are unable
to provide credentials even if they are asked to. In this case, it's
useless to wait for credentials, and it's better to immediately log
authentication errors and apply the anti-brute force algorithm.
Media-over-QUIC is a streaming protocol built upon cutting edge
protocols (QUIC, HTTP3) and browser APIs (WebTransport, WebCodecs).
It's slightly faster than WebRTC, has an advanced data recovery
mechanism (placed at the frame level and not at the packet level), it
supports additional codecs (FLAC) and is less complicated to route.
Surface user agent in the auth HTTP webhook payload as "userAgent"
and in the API structs for RTMP, RTSP, WebRTC and HLS connections.
---------
Co-authored-by: aler9 <46489434+aler9@users.noreply.github.com>
sessions are now tracked through cookies or query parameters.
This provides the ability to inspect sessions through logs, metrics and
API, allows more precise tracking of outbound bytes, decreases load on
external HTTP authentication URLs since they are now called once per
session and not once per request.
This fixes a long standing security flaw. Even though it's a breaking
change, few users should be impacted since this feature has been discouraged
for some time.
In case of RTSP and RTMP, JWTs cannot be used as passwords since
there's a size limit. Therefore, documentation is updated to suggest
passing JWT through query parameters, and authJWTInHTTPQuery is updated
to act on HTTP requests only.
Usernames and passwords must be requested explicitly to clients, but
they were not requested when JWT is meant to be passed as password.
This fixes the issue.
* Added authJWTExclude to allow exclusion of actions while using the JWT authentication method
* add test
---------
Co-authored-by: aler9 <46489434+aler9@users.noreply.github.com>
This is a new authentication system that covers all the features exposed by the server, including playback, API, metrics and PPROF, improves internal authentication by adding permissions, improves HTTP-based authentication by adding the ability to exclude certain actions from being authenticated, adds an additional method (JWT-based authentication).
