Re: [rtcweb] Same location media

[Jozsef Vass <[e-mail]>]

As for Flash, I think your are referring to the same origin policy and not media, which is true for all browsers. That means, that http://www.a.com/a.swf cannot load http://www.b.com/data.txt without an explicit permission by a cross-domain policy file.

Jozsef

From: Roman Shpount [mailto:[e-mail]]
Sent: Thursday, October 20, 2011 9:27 AM
To: Iñaki Baz Castillo
Cc: [e-mail]
Subject: [rtcweb] Same location media

Changing the topic from "A plea for simplicity, marketability..."

On Thu, Oct 20, 2011 at 11:57 AM, Iñaki Baz Castillo <[e-mail]<mailto:[e-mail]>> wrote:
Also you are asuming that the media is sent to the same IP of the web
server (in case a RTCweb scenario does not include user2user calls).
This is a too much simplified scenario, and you miss that a DNS A
record can point to N IP's, and you also miss the case in which the
webserver has an IP different than the media server (regardless they
both are located within the same provider infrastucture). The browser
cannot determine it by itself, so security is always a need, and IMHO
it's a bad idea to allow a very corner case in which such security
could be relaxed.

I am not missing the DNS issues. I wanted to bring this up in my previous email, but did not want to confuse the issue. I don't advocate for this case at all, I just wanted to clarify that "same origin media" does not necessarily mean two phones in the same location and means media going to the same location as JavaScript origination.

Few additional points related to this:

1. This is what Flash is doing now for streaming media. It does not need consent to send media to the same server that sent the flash app.

2. I am not sure we standardized that only IP addresses are allowed in media description.DNS names might still be allowed then this issue will become the issue of doing a literal match.

3. There is still a security issue with ICE: we validate that STUN request can be processed, but not that the media actually should be accepted from this application. In some sense, current Flash cross domain polices are stricter, since they not only validate that media is acceptable at this IP but that it is acceptable from the app served from particular server.

In general, I think this is a good thing if I can get readily available hardware components and connect RTC clients to my existing infrastructure (I do have an JavaScript/HTTP to SIP proxy solution already). If we are not breaking anything by doing this, there might be some benefit for allowing this. But on the other hand, I already got ICE/SRTP to non-ICE/RTP media proxy as well, so if this is not supported I will not suffer much :).

_____________
Roman Shpount