Docs/Stream/Zero-Trust & RBAC

Zero-Trust Security & Access Control

Vyntech Stream enforces a zero-trust architecture across both video ingest and audience playback, preventing token sharing, link leakage, and unauthorized broadcast access.

Broadcaster Ingest Security

Cryptographic Stream Keys

Every broadcast instance requires a 128-bit cryptographically secure stream key. When an RTMP/SRT connection is initiated, the IngestManager checks key validity against the PostgreSQL database before allocating memory.

Ingest IP Whitelisting

Tenants can restrict ingest permissions to dedicated studio IP ranges or CIDR subnets (e.g. 203.0.113.0/24). Unauthorized IP connections are closed at the TCP handshake stage.

Zero-Trust Viewer Validation

To protect paid webinars, private enterprise broadcasts, and high-value media feeds, Vyntech Stream implements dual-factor token binding:

1

JWKS Signature Verification

The viewer presents a JWT. The platform dynamically retrieves the tenant IDP public keys from https://id.vyntech.com.au/.well-known/jwks.json to verify cryptographic authenticity.

2

Contextual Token Binding (Anti-Hotlinking)

On first verification, the token's SHA-256 hash is bound in Redis to the viewer's Client IP (accounting for proxies via X-Forwarded-For) and Browser Hardware Fingerprint.

3

Tamper Enforcement

If the URL or token is forwarded to a second person or another computer, the IP/fingerprint mismatch triggers an immediate 403 Forbidden rejection.

Hierarchical Role-Based Access Control (RBAC)

RolePermissionsDescription
viewerstream:viewCan watch video and participate in chat.
moderatorstream:view, chat:moderateCan delete messages, issue timeouts, bans, and room locks.
adminstream:view, chat:moderate, stream:publish, tenant:adminCan create streams, manage keys, and execute stream-wide bans.
ownerAll Permissions (*)Full control over tenant billing, subscriptions, and integrations.

Real-Time Stream Bans & Connection Teardown

When an administrator issues a stream ban against an abusive viewer:

  • Chat WebSocket: Immediately closed with custom close code 4003 Stream Banned.
  • WebRTC SFU Teardown: The WebRTC engine searches active PeerConnection tracks mapped to the user ID and instantly invokes pc.Close(), severing video and audio feeds within milliseconds.
  • Permanent Moderation Entry: The user's IP and device fingerprint are recorded in the Redis moderation table, denying future reconnection attempts.

Execute Real-Time Stream BanAuth

Immediately evict a viewer from all active WebRTC and chat sockets, and record their IP in the Redis blocklist.

Payload Example

{
  "viewer_id": "usr_bad_actor_99",
  "reason": "Harassment and stream sniping",
  "ban_ip": true,
  "duration_seconds": 86400
}

Status Codes

  • Name
    201
    Type
    HTTP
    Description
    Stream ban executed and connections severed
  • Name
    403
    Type
    HTTP
    Description
    Requires stream:admin privileges
Request
POST/v1/stream/channels/{id}/bans
Response 201
← DVR & Cloud StorageReal-Time Chat System →

We use cookies and similar technologies to measure traffic and improve the site. You can choose which categories to allow. Manage Preferences.