I am building a WebRTC application, and really concerned about security.
I have read this quite interesting article : https://webrtc-security.github.io
As I am far from being an expert in networking security, I just want to confirm that I am doing it right, and what things should I potentially worry about.
- The WebRTC "room" is hosted on a website over HTTPS (LetsEncrypt).
- I built a websocket signaling server accessible over WSS.
- This signaling server needs to receive an "authentication" special message, containing a valid RFC7519 JsonWebToken (checking origin and expiration), before it actually allow to forward SDP offers, answers and ICE candidates. All JWT are encrypted with a 4096 bits private key.
- Once authenticated, this JWT is no longer needed, as the WebSocket server will consider a connection as authenticated untill disconnection
- I have set up a TURN server (resiprocate-turn-server) using TLS aswell, accessible for STUN and TURNS protocols :
(requiring valid username and password)
- Should I restrict the access to this STUN server to some domaine origins ?
As a web developer, do I need to worry about kind of MITM attack (actually any kind of attack?)