Search code examples
webrtcstunturn

How to protect STUN/TURN server information in JS?

I'm building a WebRTC app and the JS will have the following code (credentials are from example and not real):

{
  'iceServers': [
    {
      'url': 'stun:stun.l.google.com:19302'
    },
    {
      'url': 'turn:192.158.29.39:3478?transport=udp',
      'credential': 'JZEOEt2V3Qb0y27GRntt2u2PAYA=',
      'username': '28224511:1379330808'
    },
    {
      'url': 'turn:192.158.29.39:3478?transport=tcp',
      'credential': 'JZEOEt2V3Qb0y27GRntt2u2PAYA=',
      'username': '28224511:1379330808'
    }
  ]
}

which means that anyone can grab my credentials and use my server for their own needs.

How do I avoid this situation?

Solution

  • The most common approach is to give out credentials which expire in a couple of hours. This is described in this draft

    For example the credentials you quote are taken from this article and they expired on Mon Sep 16 2013 (from new Date(1379330808 * 1000))