Why the coturn server returning 401: Unauthorized

Viewed 1950

i have installed a Coturn server on ubunto 16 currently i'm checking it with

function checkTURNServer(turnConfig, timeout){ 

  return new Promise(function(resolve, reject){

    setTimeout(function(){
        if(promiseResolved) return;
        resolve(false);
        promiseResolved = true;
    }, timeout || 5000);

    var promiseResolved = false
      , myPeerConnection = window.RTCPeerConnection || window.mozRTCPeerConnection || window.webkitRTCPeerConnection   //compatibility for firefox and chrome
      , pc = new myPeerConnection({iceServers:[turnConfig]})
      , noop = function(){};
    pc.createDataChannel("");    //create a bogus data channel
    pc.createOffer(function(sdp){
      if(sdp.sdp.indexOf('typ relay') > -1){ // sometimes sdp contains the ice candidates...
        promiseResolved = true;
        resolve(true);
      }
      pc.setLocalDescription(sdp, noop, noop);
    }, noop);    // create offer and set local description
    pc.onicecandidate = function(ice){  //listen for candidate events
      if(promiseResolved || !ice || !ice.candidate || !ice.candidate.candidate || !(ice.candidate.candidate.indexOf('typ relay')>-1))  return;
      promiseResolved = true;
      resolve(true);
    };
  });   
}

const USERNAME="user"
const PASSWORD="password"
const PORT=3478
const IP="my_Coturn_server_ip" // you will have to change this

console.log('TURN server reachable on TCP?', await checkTURNServer( {
    url: `turn:${IP}:${PORT}?transport=tcp`,
    username: USERNAME,
    credential: PASSWORD,
}))

console.log('TURN server reachable on UDP?', await checkTURNServer( {
    url: `turn:${IP}:${PORT}?transport=udp`,
    username: USERNAME,
    credential: PASSWORD,
}))

every time i try to check i get this in the server

14: session 001000000000000001: realm user <>: incoming packet BINDING process ed, success 14: session 001000000000000001: realm user <>: incoming packet message process ed, error 401: Unauthorized 14: IPv4. Local relay addr: my_Coturn_server_ip:57906 14: session 001000000000000001: new, realm=, username=, lifetime=600 14: session 001000000000000001: realm user : incoming packet ALLOCATE pr ocessed, success 24: session 000000000000000001: realm user : incoming packet BINDING pro cessed, success

why it is returning 401 ? how i can open the server to public without authentication ?

1 Answers

The 401 is just part of the digest authentication: the first Allocate request is sent by the client without authentication data.

The server challenges the Allocate Request with a 401, providing a realm and nonce.

The client then uses the realm, nonce, username and password to compute the authentication key and send again the Allocate Request, which gets an Allocate Success Response.

The full process is explained in https://www.rfc-editor.org/rfc/rfc8656

In general TURN servers are not open to public usage without authentication because their usage is resource intensive and can become very expensive.

Related