External/mediamtx
1
0
Fork 1
mirror of https://github.com/bluenviron/mediamtx.git synced 2025-12-20 02:00:05 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

stop accepting JWTs from query parameters unless allowed in conf (#5010)

Browse source 
This is the first step into removing support for JWTs in
query parameters, which is a security flaw.
This commit is contained in:
Alessandro Ros 2025-09-22 10:04:51 +02:00 • committed by GitHub
parent 68b4c20627
commit 85f57b90db
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 3 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

17
internal/auth/manager.go
View file

@ -27,21 +27,6 @@ const (
jwksRefreshPeriod = 60 * 60 * time.Second jwksRefreshPeriod = 60 * 60 * time.Second
) )
func isHTTPRequest(r *Request) bool {
switch r.Action {
case conf.AuthActionPlayback, conf.AuthActionAPI,
conf.AuthActionMetrics, conf.AuthActionPprof:
return true
}
switch r.Protocol {
case ProtocolHLS, ProtocolWebRTC:
return true
}
return false
}
func matchesPermission(perms []conf.AuthInternalUserPermission, req *Request) bool { func matchesPermission(perms []conf.AuthInternalUserPermission, req *Request) bool {
for _, perm := range perms { for _, perm := range perms {
if perm.Action == req.Action { if perm.Action == req.Action {
@ -223,7 +208,7 @@ func (m *Manager) authenticateJWT(req *Request) error {
case req.Credentials.Pass != "": case req.Credentials.Pass != "":
encodedJWT = req.Credentials.Pass encodedJWT = req.Credentials.Pass
case (!isHTTPRequest(req) || m.JWTInHTTPQuery): case m.JWTInHTTPQuery:
var v url.Values var v url.Values
v, err = url.ParseQuery(req.Query) v, err = url.ParseQuery(req.Query)
if err != nil { if err != nil {

4
mediamtx.yml
View file

@ -119,7 +119,7 @@ authHTTPExclude:
# } # }
# ] # ]
# } # }
# Users are expected to pass the JWT in the Authorization header, password or query parameter. # Users are expected to pass the JWT in the Authorization header or as password.
# This is the JWKS URL that will be used to pull (once) the public key that allows # This is the JWKS URL that will be used to pull (once) the public key that allows
# to validate JWTs. # to validate JWTs.
authJWTJWKS: authJWTJWKS:
@ -135,7 +135,7 @@ authJWTClaimKey: mediamtx_permissions
# Format is the same as the one of user permissions. # Format is the same as the one of user permissions.
authJWTExclude: [] authJWTExclude: []
# allow passing the JWT through query parameters of HTTP requests (i.e. ?jwt=JWT). # allow passing the JWT through query parameters of HTTP requests (i.e. ?jwt=JWT).
# This is a security risk. # This is a security risk and will be disabled by default in the future.
authJWTInHTTPQuery: true authJWTInHTTPQuery: true
############################################### ###############################################