title: How to force CoTURN long term credentials validation from WebRTC Flutter application?
body: <p>I use <a href="https://github.com/cloudwebrtc/flutter-webrtc-demo/blob/master/lib/src/basic_sample/data_channel_sample.dart" rel="nofollow noreferrer">this example of Flutter data channel</a> to connect my Android app to my <a href="https://github.com/coturn/coturn" rel="nofollow noreferrer">CoTURN server</a> on my local network. The CoTURN logs show that the Android app connects successfully to the CoTURN server but doesn't show any username. I would like to make sure that no access is possible to my CoTURN server while not using long term credentials.</p>
  
  <p>The version of my CoTURN server is 4.5.1.1-1.1 on Debian Linux Stable (10 Buster). The <code>lt-cred-mech</code> is already set in the CoTURN server configuration while <code>no-auth</code> is not set (it is commented). I am using <code>verbose</code> to check the logs. I have a user created in my MySQL database for long term credentials. It is verified using this command on the secured port:</p>
  
  <pre><code>turnutils_uclient -p 5349 -u myuser -w mypassword 192.168.188.28
  </code></pre>
  
  <p>It leads to the following in the coturn logs:</p>
  
  <pre><code>1992: handle_udp_packet: New UDP endpoint: local addr 192.168.188.28:5349, remote addr 192.168.188.28:58256
  1992: session 002000000000000002: realm &lt;myrealm&gt; user &lt;&gt;: incoming packet message processed, error 401: Unauthorized
  1992: IPv4. Local relay addr: 192.168.188.28:64632
  1992: IPv4. Local reserved relay addr: 192.168.188.28:64633
  1992: session 002000000000000002: new, realm=&lt;myrealm&gt;, username=&lt;myuser&gt;, lifetime=777
  1992: session 002000000000000002: realm &lt;myrealm&gt; user &lt;myuser&gt;: incoming packet ALLOCATE processed, success
  1992: session 002000000000000002: refreshed, realm=&lt;myrealm&gt;, username=&lt;myuser&gt;, lifetime=777
  1992: session 002000000000000002: realm &lt;myrealm&gt; user &lt;myuser&gt;: incoming packet REFRESH processed, success
  ...
  2007: session 003000000000000003: delete: realm=&lt;myrealm&gt;, username=&lt;myuser&gt;
  2007: session 003000000000000003: peer 0.0.0.0:3481 deleted
  2008: session 001000000000000008: usage: realm=&lt;myrealm&gt;, username=&lt;myuser&gt;, rp=13, rb=1360, sp=8, sb=768
  2008: session 001000000000000008: closed (2nd stage), user &lt;myuser&gt; realm &lt;myrealm&gt; origin &lt;&gt;, local 192.168.188.28:5349, remote 192.168.188.28:48266, reason: allocation timeout
  2008: session 001000000000000008: delete: realm=&lt;myrealm&gt;, username=&lt;myuser&gt;
  2008: session 001000000000000008: peer 0.0.0.0:3481 deleted
  </code></pre>
  
  <p>If I try the same command with an intentionally invalid user, I get the expected following results in the server logs:</p>
  
  <pre><code>2227: handle_udp_packet: New UDP endpoint: local addr 192.168.188.28:5349, remote addr 192.168.188.28:40431
  2227: session 002000000000000003: realm &lt;myrealm&gt; user &lt;&gt;: incoming packet message processed, error 401: Unauthorized
  2227: check_stun_auth: Cannot find credentials of user &lt;myuserfaulty&gt;
  2227: session 002000000000000003: realm &lt;myrealm&gt; user &lt;myuserfaulty&gt;: incoming packet message processed, error 401: Unauthorized
  2227: check_stun_auth: Cannot find credentials of user &lt;myuserfaulty&gt;
  ...
  </code></pre>
  
  <p>So, this means that the credentials are indeed checked by the CoTURN server.</p>
  
  <p>However, when I add credentials to the Flutter app as follows, I get server logs that don't seem to show any user. Worst, if the user is intentionally faulty, it changes nothing. Here is the portion of code adapted:</p>
  
  <pre><code>...
      Map&lt;String, dynamic&gt; configuration = {
        "iceServers": [
          {"url": "stun:192.168.188.28:5349"},
          {"username": "myuserfaulty"},
          {"credential": "mypassword"},
        ]
      };
  ...
  </code></pre>
  
  <p>Note that I guessed the <code>username</code> and <code>credential</code> entries in the configuration from the following files:</p>
  
  <p><a href="https://github.com/cloudwebrtc/flutter-webrtc/blob/master/ios/Classes/FlutterWebRTCPlugin.m" rel="nofollow noreferrer">https://github.com/cloudwebrtc/flutter-webrtc/blob/master/ios/Classes/FlutterWebRTCPlugin.m</a></p>
  
  <p><a href="https://github.com/cloudwebrtc/flutter-webrtc/blob/master/android/src/main/java/com/cloudwebrtc/webrtc/FlutterWebRTCPlugin.java" rel="nofollow noreferrer">https://github.com/cloudwebrtc/flutter-webrtc/blob/master/android/src/main/java/com/cloudwebrtc/webrtc/FlutterWebRTCPlugin.java</a></p>
  
  <p>Here are the CoTURN logs while using intentionally wrong credentials from Flutter:</p>
  
  <pre><code>2945: handle_udp_packet: New UDP endpoint: local addr 192.168.188.28:5349, remote addr 192.168.188.31:58350
  2945: session 002000000000000004: realm &lt;myrealm&gt; user &lt;&gt;: incoming packet BINDING processed, success
  2955: session 002000000000000004: realm &lt;myrealm&gt; user &lt;&gt;: incoming packet BINDING processed, success
  2965: session 002000000000000004: realm &lt;myrealm&gt; user &lt;&gt;: incoming packet BINDING processed, success
  2975: session 002000000000000004: realm &lt;myrealm&gt; user &lt;&gt;: incoming packet BINDING processed, success
  2985: session 002000000000000004: realm &lt;myrealm&gt; user &lt;&gt;: incoming packet BINDING processed, success
  2995: session 002000000000000004: realm &lt;myrealm&gt; user &lt;&gt;: incoming packet BINDING processed, success
  3005: session 002000000000000004: usage: realm=&lt;myrealm&gt;, username=&lt;&gt;, rp=6, rb=120, sp=6, sb=528
  3005: session 002000000000000004: closed (2nd stage), user &lt;&gt; realm &lt;myrealm&gt; origin &lt;&gt;, local 192.168.188.28:5349, remote 192.168.188.31:58350, reason: allocation watchdog determined stale session state
  3005: handle_udp_packet: New UDP endpoint: local addr 192.168.188.28:5349, remote addr 192.168.188.31:58350
  3005: session 002000000000000005: realm &lt;myrealm&gt; user &lt;&gt;: incoming packet BINDING processed, success
  3015: session 002000000000000005: realm &lt;myrealm&gt; user &lt;&gt;: incoming packet BINDING processed, success
  ...
  </code></pre>
  
  <p>So, I have the following questions:</p>
  
  <ol>
  <li><p>How can I make sure that my CoTURN server cannot be used without authorized long term credentials?</p></li>
  <li><p>How come the Flutter app is not subject to the same credentials validation as the <code>turnutils_uclient</code>?</p></li>
  <li><p>Did I guess correctly the way to specify the credentials in the Flutter app with the addition of the <code>username</code> and <code>credential</code> entries in the configuration?</p></li>
  </ol>