URL authentication with '@' working weird in 5.2.1482

[Sukwon Choi]

Hi, I changed rtsp password recently with '@' character included.

I tried several ways, but it's quite working weird.

I sent you a rtsp url with private form.

Let's say my rtsp url is

username:password@@example.stream

on WCS 5.2.1482 both

username:password%40@example.stream

and

username:password%2540@example.stream

throw Failed to connect to rtsp stream Error.

However, on WCS 5.2.944

username:password%2540@example.stream

works without error.

on VLC,

username:password%40@example.stream

and

username:password@@example.stream

works well.

 

[Max]

Good day.
Unfortunately, VLC does not play the stream by URL and credentials you've provided:

Seems like something wrong with RTSP URL itself or with RTSP camera configuration. Please check.

 

[Sukwon Choi]

I sent you rtsp url with form

username:password%2540@example.stream

, to open rtsp url in VLC you should try

username:password%40@example.stream

or

username:password@@example.stream

I just resent correct rtsp url.

 

[Max]

Seems like the stream is successfully playing on demo server (5.2.1489):

Please update to the latest build 5.2.1494 (which includes the fix you requested in this topic).
You can update WCS in the instance as described here:

sudo systemctl stop webcallserver
cd /usr/local/FlashphonerWebCallServer/bin
sudo ./webcallserver update
sudo systemctl start webcallserver

 

[Sukwon Choi]

Thank you for your fast reply.

I updated to 5.2.1494 version, and check that previous issue had been fixed!

However, this rtsp url is still not working

I tried to downgrade wcs version to 5.2.1489, but it failed with this message.

 

[Max]

However, this rtsp url is still not working

Please provide SSH access to the server using this form.

 

[Sukwon Choi]

Please provide SSH access to the server using this form.

Yes I sent you a SSH access info.

 

[Max]

Unfortunately, where is no WCS installed and running on the server instance accessible by credentials provided:

So we cannot test your stream with your server settings.
If you can't provide an access to the server where the issue is reproducing, please do the following:
1. Restart WCS
2. Start traffic dump collection

tcpdump -npi any -B 10240 -w log.pcap

3. Open RTSP URL in Player example https://wcs:8444/client2/examples/demo/streaming/player/player.html
4. Stop traffic dump collection
5. Collect a report using report.sh script:

cd /usr/local/FlashphonerWebCallServer/tools
sudo ./report.sh --sysinfo --conf --tar

6. Add the traffic dump to the report and send using this form.

 

[Sukwon Choi]

I resent you a SSH access info. Sorry for my mistake.

 

[Max]

We checked the server (the settings seems to be default for AWS instance). RTSP stream with password ending by @ char is playing correctly:

However please note that Nack Count and Packets Lost parameters are big, so it is recommended to play the stream via TCP to prevent losses.

 

[Sukwon Choi]

It works once, then suddenly it failed again.

However, on 5.2.944 it always works.

Could you check one more time for this intermittent bug?

Beside, I tested with Embed Player demo not Media Devices. Could this be the reason?

Thanks.

 

[Max]

We tested the stream both with builds 5.2.944 and 5.2.1494. It does not work with Embed Player, the exception is displayed in server logs:

14:54:38,128 ERROR           RtspAgents - API-ASYNC-pool-13-thread-4 Can't create rtspClient
com.flashphoner.server.commons.rmi.operations.exception.UrlConflictException: Bad URI

That's because the Embed Player (and only this example) uses URL parameters to get a stream name to play, and applies the function decodeURIComponent() to the stream name, so %40 is decoded back to @ character.
In other hand, it is extremely unsecure to pass login and password in URL parameters. We recommend to hide the credentials form end user. For example, start RTSP playback on server via REST API

POST /rest-api/rtsp/startup HTTP/1.1
Host: localhost:8081
Content-Length: 56
Content-Type: application/json
 
{
    "uri": "rtsp://username:password%40@server:554/Streaming/Unicast/channels/101",
    "localStreamName": "rtsp_stream1"
}

then play it in Embed Player by name rtsp_stream1
Or, in more complex way, use REST hook /playStream: Redefining fields. In this case, the real RTSP stream name and credentials are known on backend only, so end user cannot get them by any way.

 

[Max]

You can also tweak Embed Player if you don't care about security. In the file /usr/local/FlashphonerWebCallServer/client2/examples/demo/streaming/embed_player/utils.js, replace at string 25

return decodeURIComponent(results[2].replace(/\+/g, " "));

to

return results[2].replace(/\+/g, " ");

This should help to play such RTSP stream.

 

[Sukwon Choi]

You can also tweak Embed Player if you don't care about security. In the file /usr/local/FlashphonerWebCallServer/client2/examples/demo/streaming/embed_player/utils.js, replace at string 25

return decodeURIComponent(results[2].replace(/\+/g, " "));

to

return results[2].replace(/\+/g, " ");

This should help to play such RTSP stream.

Thanks. That was why I replace "@" to"%2540".

 

[Max]

Thanks. That was why I replace "@" to"%2540".

%2540 is not equal to %40: https://www.compart.com/en/unicode/U+2540
We raised the ticket WCS-3655 to add a workaround to Embed Player because simple decoding removing breaks other streams playback.

 

[Max]

Good day.
We fixed the Embed Player issue in Web SDK build 2.0.227.