API: Secure HTTP API for Authentication. Port 1985 does not have any security authentication.

[caijian76]

Description'

Please ensure that the markdown structure is maintained.

Currently, the program is used to kick out timed-out streaming clients through the API. However, it has been observed that anyone with a basic understanding of SRS can view and even kick out legitimate clients. Is there any way to avoid this issue?
I saw a post earlier that mentioned listening to port 1985 on 127.0.0.1 and then using another HTTP proxy to achieve this. Could you please explain how to implement the above method in a Docker deployment environment?

1. SRS version: v3
2. Deployment method: k8s

TRANS_BY_GPT3

[winlinvip]

CN

Due to the fact that authentication issues are business-related, the authentication methods designed for different business systems are completely different. Therefore, the API of SRS itself is not suitable for authentication capabilities.

The most suitable approach is to have SRS listen on 127.0.0.1:1985, isolated from the network to prevent external user access. Then, use Go or Nodejs to write an API server that reverse proxies to SRS's API. This way, you can implement authentication according to your own business requirements.

Similarly, this approach also supports HTTPS API. For example, you can use Nginx or Go to proxy once and support HTTPS API. Then, this proxy can access SRS's API. Please refer to #2881 for more information.

EM

SRS won't support HTTP API authentication, or token verify, because authentication is defined by your business system. Different user has different business system, so it's impossible for SRS to verify the user for HTTP API.

The best solution is to config SRS to listen at 127.0.0.1:1985, which force the HTTP API to listen at lo or internal network. Then, use Go or Nodejs server to verify the user and proxy to SRS HTTP API.

And this also works for HTTPS API, for example, to use NGINX or Go to covert HTTPS to HTTP, see #2881

TRANS_BY_GPT3

[winlinvip]

Besides listening at localhost, we should support a Go proxy with authenticatino and some basic authentication.

Go proxy:

Client ---HTTP------> Go HTTP API ---HTTP-------> SRS HTTP API
                             (listen at public with auth)        (listen at localhost without auth)

SRS HTTP API with basic authentication:

Client ----HTTP-----> SRS HTTP API
                                      (with basic authentication)

See grafana Authentication API