TURN Server Auth

[spooketti]

In development, we ran into an issue with people locked behind a CG-NAT not being able to use WebRTC

While I am not 100% sure this is the true cause, there appear to be issues with IPv6, and STUN servers are not known to work with CG-NAT anyway, but TURN has a chance

The only issue: TURN requires auth (user/PW), so there are 3 levels of security to be considered

Given Relay is not meant to be large scale and the server addresses are meant to be decently hidden, the 3 levels that seem appropriate were:

1. no security --> this isn't as problematic as it seems, STUN is meant ot be priority, and TURN is just for those who are locked behind some form of security, and these servers aren't meant to be used large scale

This is prone to exploits for obvoius reasons

2. light security --> users login and then receieve the turn server credentials (constant in the server)

This is prone to users finding the credentials and then using the turn server for their own reasons

3. standard security --> users use their login credentials as their turn server credentials

This is the most secure as someone exploiting the server for their own needs will have the account they are using it on logged, but this requires a high amount of work (query the db for all the known users and password and keep this list updated when a new account is created)
This is also in context of a service that most people are not going to be using anyway (if you want a TURN server that badly you will just host your own + majoirty are meant to route through STUN)

If this becomes an issue, level 3 security will be the new standard, unless there is a really obvoius other solution that i am missing
(admittedly i only somewhat understand the nuance of TURN auth)

[spooketti]

on second thought its probably better to do level 3 as all the login information exists anyway