open-chat
open-chat copied to clipboard
Enhance peerjs server
There are a few potential problems with our peerjs signalling server.
- shared service controlled by someone else - this is a vulnerability if not a current problem
- The server maps a userId to at most one connection. This does not cover the common case where a user has more than one device open.
- Signalling messages are not authenticated in any way which means that in principle it would be possible to fake a webrtc message if you know another user's userId (which is not secret information).
There is potential to fix all three of these problems by forking the peerjs server and modifying it and then hosting it ourselves.
Since this implies multiple webrtc connections to a single peer (on multiple devices) this would also require changes to peerjs client. At which point it might be simpler to switch to simple-peer and use a completely custom signalling server that meets our requirements exactly.