## Chapter 13. Security

This document describes the Red5 API that was introduced in version 0.6 to protect access to streams and/or shared objects similar to what the properties Client.readAccess and Client.writeAccess provide in the Macromedia Flash Communication Server / Flash Media Server 2.

## 13.1. Stream Security

Read (playback) and write (publishing/recording) access to streams is protected separately in Red5.

### 13.1.1. Stream playback security

For applications that want to limit the playback of streams per user or only want to provide access to streams with a given name, the interface IStreamPlaybackSecurity http://dl.fancycode.com/red5/api/org/red5/server/api/stream/IStreamPlaybackSecurity.html is available in Red5.

It can be implemented by any object and registered in the ApplicationAdapter http://dl.fancycode.com/red5/api/org/red5/server/adapter/ApplicationAdapter.html . An arbitrary number of stream security handlers is supported per application. If at least one of the handlers denies access to the stream, the client receives an error NetStream.Failed with a description field giving a corresponding error message.

An example handler that only allows access to streams that have a name starting with liveStream is described below:

    import org.red5.server.api.IScope;
    import org.red5.server.api.stream.IStreamPlaybackSecurity;

    public class NamePlaybackSecurity implements IStreamPlaybackSecurity {

        public boolean isPlaybackAllowed(IScope scope, String name, int start,
         int length, boolean flushPlaylist) {
             if (!name.startswith("liveStream")) {
                return false;
             } else {
                return true;
             }
         };
    }

To register this handler in the application, add the following code in the appStart method:

    registerStreamPlaybackSecurity(new NamePlaybackSecurity());

Red5 includes a sample security handler that denies all access to streams (DenyAllStreamAccess http://dl.fancycode.com/red5/api/org/red5/server/api/stream/support/DenyAllStreamAccess.html).

### 13.1.2. Stream publishing security

In most applications that allow the user to publish and/or record streams, this access must be limited to prevent the server from being misused. Therefore, Red5 provides the interface IStreamPublishSecurity http://dl.fancycode.com/red5/api/org/red5/server/api/stream/IStreamPublishSecurity.html to deny publishing of certain streams.

Similar to IStreamPlaybackSecurity http://dl.fancycode.com/red5/api/org/red5/server/api/stream/IStreamPlaybackSecurity.html, it can be implemented by any object and registered in the ApplicationAdapter http://dl.fancycode.com/red5/api/org/red5/server/adapter/ApplicationAdapter.html. If one of the registered handlers denies access, the client receives an error NetStream.Failed with a description field giving a corresponding error message.

An example handler that only allows authenticated connections to publish a live stream starting with liveStream and deny all other access is described below:

Prev | Home | Next
Chapter 12. Customize Stream Paths | Red5 Open Source Flash Server | Chapter 14. Scripting Implementations