Repository navigation
TURN Server should require same username used for creation+access of allocation #120
Description
We should store the username used to create the allocation, and then assert that it hasn't changed across requests
All requests after the initial Allocate must use the same username as
that used to create the allocation, to prevent attackers from
hijacking the client's allocation. Specifically, if the server
requires the use of the long-term credential mechanism, and if a non-
Allocate request passes authentication under this mechanism, and if
the 5-tuple identifies an existing allocation, but the request does
not use the same username as used to create the allocation, then the
request MUST be rejected with a 441 (Wrong Credentials) error.
Activity
[-]TURN Server should require same MessageIntegrity used for creation+access of allocation[/-][+]TURN Server should require same username used for creation+access of allocation[/+]Check username for existing Allocations
Check username for existing Allocations
Check username for existing Allocations