CODEWITHSUNDEEP
flash-media-server
Harry Ninh
Harry Ninh

Reputation: 16728

Flash Media Server: How to fully protect stream?

I am developing a lightweight protection mechanism on FMS. Currently, I can authenticate user using SSO Token provided by main server. However, authenticating SSO Token requires WebService/RemoteObject of another server, which is expensive and unrealistic for large number of concurrent users. Hence, I created a session for each successfully validated user, returned session ID back to user and user can use this for further connections.

What I have to concern in this solution is session hijacking attack. An imposter can use that session ID to get my stream, if he successfully sniffed my customer's request. To prevent this, I have two solutions: First, every client will create two connections to server, one SSL for control message (e.g. NetConnection.call function), one for streaming data. The other is creating a secured RTMPE channel to get the stream. Both require more processing power to implement (15% more for the latter, don't know how much is the former).

Is there any better solution for my problem?

Upvotes: 1

Views: 301

Answers (1)

Danilo Moret
Danilo Moret

Reputation: 1670

There's no way you can prevent your session token from being hijacked without some communication between your FMS and your SSO server.

The least you could do is create a single use token when your client goes through the SSO side, store it, and when the player connects to FMS you invalidate that token. You could use a redis+nginx setup to handle those tokens, make your SSO store them there and write a plugin on FMS to expire them instead of using WebServices or RemoteObjects.

Happy coding! 8)

Upvotes: 1

Related Questions