Limiting who can stream to an instance

[SniperAsh6]

Discussed with @Sean-Der on Discord so raising here to discuss further and welcome suggestions from others.

The ask was whether there's anything in place or that can be easily added to limit who can stream to an instance of Broadcast Box as presently if someone can connect to watch something they can also stream to it which could quite easily be abused.

One such idea was about adding a query parameter which is a token set, potentially, as an environment variable so that only when they match will the input stream be allowed. An alternative suggestion from Sean was of the possibility of using nginx and how it may have other advantages for serving static content too

[mpisat]

Webhooks would be much better. This way a custom backend in any language can authorize publish and view events easily.

[Sean-Der]

I agree. Would you be interested in helping start this @mpisat ?

Maybe you set a URL per instance. Then have a JSON body with event and other data

[mpisat]

I will try to implement something, test it, and if I'm satisfied with the result, I'll send a MR.

[mpisat]

I have this one
mpisat#1

and provided a simple go backend to receive webhooks (and allow them)

root@sin:~/broadcast-box# ./broadcast-box
2024/07/15 23:59:12 Loading .env.production
2024/07/15 23:59:12 Running HTTP Server at :8080
2024/07/15 23:59:24 Starting webhook call to http://localhost:8081/webhook with timeout 0 ms
2024/07/15 23:59:24 Sending webhook request...
2024/07/15 23:59:24 Received webhook response with status code 200 after 3.658376ms

on Go mock backend side:
2024/07/15 23:59:24 Incoming webhook payload:
{
"action": "publish",
"streamKey": "murat",
"ip": "[2403:6200:8976:bf79:a123:b51a:3a33:2760]:64286",
"bearerToken": "murat",
"queryParams": {},
"userAgent": "Go-http-client/1.1"
}

if it is set to deny
2024/07/16 00:02:27 Sending webhook request...
2024/07/16 00:02:27 Received webhook response with status code 403 after 1.083348ms
2024/07/16 00:02:27 Webhook denied access

you can be creative and provide queryparams to streamkey for view authorization, but it will require further code changes.
for publishing, it is working out of the box.

I can send an MR if code quality is acceptable.

[neilschark]

Hello,

I just found this project and would be interested in a variant with exactly this webhook implementation. I wanted to implement something like this MR myself and open a M, but found this issue and the code @mpisat already implemented.

Whats the current status of this? It seems a bit abandoned....

I would then be interesting in providing an example implementation for such a authentication backend, but it would depend on the webhook integration.

[Sean-Der]

Hi @neilschark

project isn’t abandoned I am actively working on it! Are you interested in adding webhook support?

I would love to review and merge it!

[mpisat]

@neilschark you can use my fork if you want. for publishing it works out of the box. for playback, well, it requires more work.

[neilschark]

@Sean-Der

Yes, I would be interested to help with an integration. My current plan is to use the Webhook implementation @mpisat started and add a webserver for the authentication, which is just a reference implementation to use out of the box.

Unfortunately I have no knowledge in frontend development, so the frontend must be done by someone else.

I would only start with an implementation to limit streaming to the server, not limiting watching of a stream.

I will open a PR when I am ready.

[Sean-Der]

Fantastic @neilschark !

You don’t even need to make a reference server. Just add a env variable WHIP_WEBHOOK_URL and if set must return a 200.

the request should be JSON with details of the request I think? Src IP, user angent and maybe just stream key for now?

[neilschark]

If you just want the webhook implementation, you can use this mr https://github.com/mpisat/broadcast-box/pull/1/files by @mpisat

Maybe he could create a proper PR in this project.

I have an idea building a small reference implementation which uses OAuth2 for simple user management in go based on pocketbase, so that an admin of broadcast-box wouldn't have to provide his own backend for that, but could if he would choose to.

I hope to have a pr ready soon, where we could then discuss if the idea is good or not.

[mpisat]

I can modify PR to limit it to only publishers if needed.

[Sean-Der]

@mpisat I would love to see both!

Sorry I didn’t know you had done this work, I will do a better job of reviewing PRs in the future :(

[mpisat]

I didn't send PR to your repo, I wasn't sure if my solution was acceptable, so I keep it in my fork. I probably need to modify it a bit to make it optional. right now it expects WEBHOOK_URL
it was just a PoC

[Sean-Der]

Just looked at your repo, the code looks really good! I would love to get this merged

[mpisat]

I can send a PR but it will require a backend service for WEBHOOK_URL
I can make it optional, and send a new one, so it doesn't break anything by default.