Search code examples
javascriptfirefoxhttpswebrtcmozilla

WebRTC screen capture is still unsafe even if HTTPS is used



I'm trying to catch the screen and display it in the browser (Mozilla Firefox). For that purpose I use WebRTC and web-server. HTML and JS are here:

$(document).ready(function() {

    screen_constraints = { 
        video: {
          mediaSource: "screen"
        }   
    };

    navigator.getUserMedia = navigator.getUserMedia || navigator.webkitGetUserMedia || window.navigator.mozGetUserMedia || navigator.msGetUserMedia;
    window.URL = window.URL || window.webkitURL;
    navigator.getUserMedia(screen_constraints, onstream, onerror);

    function onstream(stream) {

        var video = document.querySelector('video');
        video.src = window.URL.createObjectURL(stream);
        video.play();
    }

    function onerror(e) {

      console.error(e); 
    }
});
<!DOCTYPE html>
<head>
<script type="text/javascript" src="jquery-2.1.4.js"></script>
<script type="text/javascript" src="scripts.js"></script>
</head>
<body>

        <video autoplay></video>

</body>
</html>

But after executing this code the error occurs and console shows:

MediaStreamError { name: "SecurityError", message: "The operation is insecure.", constraint: "", stack: "" }

The console also shows the warning before error: "This site uses the SHA-1 certificate; it is recommended to use certificates with the signature algorithms that use stronger hash than SHA-1.". I'm using HTTPS, and I've added my site to the exceptions list of my browser and allowed all permissions for it, but this error occurs constantly :(
Please, help me to resolve this problem!


Solution

  • Probably this is because of same origin issue. Make sure the flags are set correctly in about:config,

    • make sure media.getusermedia.screensharing.enabled is set true

    • and the media.getusermedia.screensharing.allowed_domains list contains your domain name( including the www. if it is that way in your certs),

    • and as for the This site uses the SHA-1 certificate;... warning, you can ignore it, it does not affect screen sharing.