From 6b57c5187bddcd30475cd3a40b8a10c33904491b Mon Sep 17 00:00:00 2001
From: Alessandro Ros <aler9.dev@gmail.com>
Date: Wed, 24 Sep 2025 18:28:53 +0200
Subject: [PATCH] webrtc: add authentication parameters to publisher.js and
 reader.js (#5026)

add user, pass and token configuration parameters.
---
 internal/servers/webrtc/publisher.js | 18 ++++++++++++++++++
 internal/servers/webrtc/reader.js    | 22 +++++++++++++++++++++-
 2 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/internal/servers/webrtc/publisher.js b/internal/servers/webrtc/publisher.js
index 62ae52b3..8304f550 100644
--- a/internal/servers/webrtc/publisher.js
+++ b/internal/servers/webrtc/publisher.js
@@ -13,6 +13,9 @@
  * @typedef Conf
  * @type {object}
  * @property {string} url - absolute URL of the WHIP endpoint.
+ * @property {string} user - username.
+ * @property {string} pass - password.
+ * @property {string} token - token.
  * @property {MediaStream} stream - stream that contains outgoing tracks.
  * @property {string} videoCodec - outgoing video codec.
  * @property {number} videoBitrate - outgoing video bitrate.
@@ -276,9 +279,23 @@ class MediaMTXWebRTCPublisher {
     }
   }
 
+  #authHeader() {
+    if (this.conf.user !== undefined && this.conf.user !== '') {
+      const credentials = btoa(`${this.conf.user}:${this.conf.pass}`);
+      return {'Authorization': `Basic ${credentials}`};
+    }
+    if (this.conf.token !== undefined && this.conf.token !== '') {
+      return {'Authorization': `Bearer ${this.conf.token}`};
+    }
+    return {};
+  }
+
   #requestICEServers() {
     return fetch(this.conf.url, {
       method: 'OPTIONS',
+      headers: {
+        ...this.#authHeader(),
+      },
     })
       .then((res) => MediaMTXWebRTCPublisher.#linkToIceServers(res.headers.get('Link')));
   }
@@ -325,6 +342,7 @@ class MediaMTXWebRTCPublisher {
     return fetch(this.conf.url, {
       method: 'POST',
       headers: {
+        ...this.#authHeader(),
         'Content-Type': 'application/sdp',
       },
       body: offer,
diff --git a/internal/servers/webrtc/reader.js b/internal/servers/webrtc/reader.js
index 3bcec7ba..3048bb1f 100644
--- a/internal/servers/webrtc/reader.js
+++ b/internal/servers/webrtc/reader.js
@@ -14,6 +14,9 @@
  * @typedef Conf
  * @type {object}
  * @property {string} url - absolute URL of the WHEP endpoint.
+ * @property {string} user - username.
+ * @property {string} pass - password.
+ * @property {string} token - token.
  * @property {OnError} onError - called when there's an error.
  * @property {OnTrack} onTrack - called when there's a track available.
  */
@@ -403,9 +406,23 @@ class MediaMTXWebRTCReader {
       });
   }
 
+  #authHeader() {
+    if (this.conf.user !== undefined && this.conf.user !== '') {
+      const credentials = btoa(`${this.conf.user}:${this.conf.pass}`);
+      return {'Authorization': `Basic ${credentials}`};
+    }
+    if (this.conf.token !== undefined && this.conf.token !== '') {
+      return {'Authorization': `Bearer ${this.conf.token}`};
+    }
+    return {};
+  }
+
   #requestICEServers() {
     return fetch(this.conf.url, {
       method: 'OPTIONS',
+      headers: {
+        ...this.#authHeader(),
+      },
     })
       .then((res) => MediaMTXWebRTCReader.#linkToIceServers(res.headers.get('Link')));
   }
@@ -446,7 +463,10 @@ class MediaMTXWebRTCReader {
 
     return fetch(this.conf.url, {
       method: 'POST',
-      headers: {'Content-Type': 'application/sdp'},
+      headers: {
+        ...this.#authHeader(),
+        'Content-Type': 'application/sdp',
+      },
       body: offer,
     })
       .then((res) => {