Feature Request: securely get the session ID via HTTPS and use it in HTTP calls to the video/audio-* URLs

[nanosonde]

Currently, the module sends the username/password credentials unencrypted in the HTTP calls to the video and audio-receive/audio-transmit URLs.
As described in the LAN API document there is another way of securely using those media URLs.
Use the getsession.cgi URL securely via HTTPS with the username/password credentials. This way they are protected.
Then use the session ID in the URLs which point to the media by appending the ?sessionid= parameter. The media URLs are not accessible via HTTPS, only via HTTP.

[ihrigb]

Hi @nanosonde

I absolutely support this request and in fact I already started to work on this. If you are interested, I can share my work in a separate branch.

BR,
Benjamin

[nanosonde]

Great news!
BTW: I plan to use your module here: https://github.com/nanosonde/scrypted/tree/doorbird__plugin

[ihrigb]

I linked the development branch for this (dev-https).

[nanosonde]

Thanks.

Just for the records: the RTSP live video endpoint is protected by standard RTSP authentication. I have just verified with Wireshark and VLC connecting to my Doorbird that the DIGEST auth scheme is supported and used.

Important, because I require RTSP as well. If it would have only been BASIC auth, I would have suggested to skip this whole HTTPS implementation as the password would have been send plain-text (base64) over the wire anyway.
Now, luckily this does not seem to be the case.

[ihrigb]

@nanosonde HTTPS is now supported as of version 2.2.0 (https://github.com/ihrigb/node-doorbird/releases/tag/v2.2.0)