Chapter 13. Security

This document describes the Red5 API that was introduced in version 0.6 to protect access to streams and/or shared objects similar to what the properties Client.readAccess and Client.writeAccess provide in the Macromedia Flash Communication Server / Flash Media Server 2.

13.1. Stream Security

Read (playback) and write (publishing/recording) access to streams is protected separately in Red5.

13.1.1. Stream playback security

For applications that want to limit the playback of streams per user or only want to provide access to streams with a given name, the interface IStreamPlaybackSecurity http://dl.fancycode.com/red5/api/org/red5/server/api/stream/IStreamPlaybackSecurity.html is available in Red5.

It can be implemented by any object and registered in the ApplicationAdapter http://dl.fancycode.com/red5/api/org/red5/server/adapter/ApplicationAdapter.html . An arbitrary number of stream security handlers is supported per application. If at least one of the handlers denies access to the stream, the client receives an error NetStream.Failed with a description field giving a corresponding error message.

An example handler that only allows access to streams that have a name starting with liveStream is described below:



import org.red5.server.api.IScope; 
import org.red5.server.api.stream.IStreamPlaybackSecurity; 
            
public class NamePlaybackSecurity implements IStreamPlaybackSecurity { 
            
    public boolean isPlaybackAllowed(IScope scope, String name, int start, 
     int length, boolean flushPlaylist) { 
         if (!name.startswith("liveStream")) { 
            return false; 
         } else { 
            return true; 
         } 
     };             
} 

To register this handler in the application, add the following code in the appStart method:



registerStreamPlaybackSecurity(new NamePlaybackSecurity()); 

Red5 includes a sample security handler that denies all access to streams (DenyAllStreamAccess http://dl.fancycode.com/red5/api/org/red5/server/api/stream/support/DenyAllStreamAccess.html).

13.1.2. Stream publishing security

In most applications that allow the user to publish and/or record streams, this access must be limited to prevent the server from being misused. Therefore, Red5 provides the interface IStreamPublishSecurity http://dl.fancycode.com/red5/api/org/red5/server/api/stream/IStreamPublishSecurity.html to deny publishing of certain streams.

Similar to IStreamPlaybackSecurity http://dl.fancycode.com/red5/api/org/red5/server/api/stream/IStreamPlaybackSecurity.html, it can be implemented by any object and registered in the ApplicationAdapter http://dl.fancycode.com/red5/api/org/red5/server/adapter/ApplicationAdapter.html. If one of the registered handlers denies access, the client receives an error NetStream.Failed with a description field giving a corresponding error message.

An example handler that only allows authenticated connections to publish a live stream starting with liveStream and deny all other access is described below: