Security with Red5 0.6

Stream playback security

For applications that want to limit the playback of streams per user or only want to provide access to streams with a given name, the interface IStreamPlaybackSecurity is available in Red5.

It can be implemented by any object and registered in the ApplicationAdapter. An arbitrary number of stream security handlers is supported per application. If at least one of the handlers denies access to the stream, the client receives an error NetStream.Failed with a description field giving a corresponding error message.

An example handler that only allows access to streams that have a name starting with liveStream is described below:

import org.red5.server.api.IScope;
import org.red5.server.api.stream.IStreamPlaybackSecurity;

public class NamePlaybackSecurity implements IStreamPlaybackSecurity {

  public boolean isPlaybackAllowed(IScope scope, String name, int start,
    int length, boolean flushPlaylist) {
      if (!name.startswith("liveStream")) {
          return false;
      } else {
          return true;
      }
  };
  
}

To register this handler in the application, add the following code in the appStart method:

registerStreamPlaybackSecurity(new NamePlaybackSecurity());

Red5 includes a sample security handler that denies all access to streams (DenyAllStreamAccess).

Stream publishing security

In most applications that allow the user to publish and/or record streams, this access must be limited to prevent the server from being misused. Therefore, Red5 provides the interface IStreamPublishSecurity to deny publishing of certain streams.

Similar to IStreamPlaybackSecurity, it can be implemented by any object and registered in the ApplicationAdapter. If one of the registered handlers denies access, the client receives an error NetStream.Failed with a description field giving a corresponding error message.

An example handler that only allows authenticated connections to publish a live stream starting with liveStream and deny all other access is described below:

import org.red5.server.api.IConnection;
import org.red5.server.api.IScope;
import org.red5.server.api.Red5;
import org.red5.server.api.stream.IStreamPublishSecurity;

public class AuthNamePublishSecurity implements IStreamPublishSecurity {

  public isPublishAllowed(IScope scope, String name, String mode) {
      if (!"live".equals(mode)) {
          // Not a live stream
          return false;
      }
  
      IConnection conn = Red5.getConnectionLocal();
      if (!"authenticated".equals(conn.getAttribute("UserType"))) {
          // User was not authenticated
          return false;
      }
      
      if (!name.startswith("liveStream")) {
          return false;
      } else {
          return true;
      }
  };
  
}

To register this handler in the application, add the following code in the appStart method:

registerStreamPublishSecurity(new AuthNamePublishSecurity());

Of course, you will also have to add code in one of the *Connect or *Join methods that set the UserType attribute of a connection to authenticated for users that are allowed to publish streams.

Red5 includes a sample security handler that denies all access to streams (DenyAllStreamAccess).