Zero-Trust Security & Access Control
Vyntech Stream enforces a zero-trust architecture across both video ingest and audience playback, preventing token sharing, link leakage, and unauthorized broadcast access.
Broadcaster Ingest Security
Cryptographic Stream Keys
Every broadcast instance requires a 128-bit cryptographically secure stream key. When an RTMP/SRT connection is initiated, the IngestManager checks key validity against the PostgreSQL database before allocating memory.
Ingest IP Whitelisting
Tenants can restrict ingest permissions to dedicated studio IP ranges or CIDR subnets (e.g. 203.0.113.0/24). Unauthorized IP connections are closed at the TCP handshake stage.
Zero-Trust Viewer Validation
To protect paid webinars, private enterprise broadcasts, and high-value media feeds, Vyntech Stream implements dual-factor token binding:
JWKS Signature Verification
The viewer presents a JWT. The platform dynamically retrieves the tenant IDP public keys from https://id.vyntech.com.au/.well-known/jwks.json to verify cryptographic authenticity.
Contextual Token Binding (Anti-Hotlinking)
On first verification, the token's SHA-256 hash is bound in Redis to the viewer's Client IP (accounting for proxies via X-Forwarded-For) and Browser Hardware Fingerprint.
Tamper Enforcement
If the URL or token is forwarded to a second person or another computer, the IP/fingerprint mismatch triggers an immediate 403 Forbidden rejection.
Hierarchical Role-Based Access Control (RBAC)
| Role | Permissions | Description |
|---|---|---|
| viewer | stream:view | Can watch video and participate in chat. |
| moderator | stream:view, chat:moderate | Can delete messages, issue timeouts, bans, and room locks. |
| admin | stream:view, chat:moderate, stream:publish, tenant:admin | Can create streams, manage keys, and execute stream-wide bans. |
| owner | All Permissions (*) | Full control over tenant billing, subscriptions, and integrations. |
Real-Time Stream Bans & Connection Teardown
When an administrator issues a stream ban against an abusive viewer:
- Chat WebSocket: Immediately closed with custom close code
4003 Stream Banned. - WebRTC SFU Teardown: The WebRTC engine searches active
PeerConnectiontracks mapped to the user ID and instantly invokespc.Close(), severing video and audio feeds within milliseconds. - Permanent Moderation Entry: The user's IP and device fingerprint are recorded in the Redis moderation table, denying future reconnection attempts.
Execute Real-Time Stream BanAuth
Immediately evict a viewer from all active WebRTC and chat sockets, and record their IP in the Redis blocklist.
Payload Example
{
"viewer_id": "usr_bad_actor_99",
"reason": "Harassment and stream sniping",
"ban_ip": true,
"duration_seconds": 86400
}Status Codes
- Name
201- Type
- HTTP
- Description
- Stream ban executed and connections severed
- Name
403- Type
- HTTP
- Description
- Requires stream:admin privileges