WebRTC Authorization?

[tschettervictor]

Question

How does on include the auth credentials in the url when publishing a webrtc stream?

[mav8erick]

Hey,

I think I have the same question. Unfortunately, it's not fully explained here. https://github.com/bluenviron/mediamtx?tab=readme-ov-file#webrtc-clients
If I deactivate the internal authentication, I can stream without a stream key.

[aler9]

Hello, including auth credentials in the URL is a security flaw that is blocked by all browsers for security reasons. Credentials should not be propagated together with URLs.

Instead of credentials, you can use JWTs and append them to the URL in this format:

http://localhost:8889/mystream?jwt=MY_JWT

JWTs have a limited lifetime and therefore are more secure. Instructions on how to setup JWTs are in the README.

Regarding OBS, in OBS there's a dedicated space called "Bearer Token" in which you can either put plain credentials in this format:

username:password

or, if JWTs are enabled, you can just put the JWT.