Skip to main content

Access Overview

As you build out your live streaming platform using Native Frame, implementing robust authentication and authorization is crucial to ensure only authorized users can broadcast and control who has access to view streams. This document provides an overview of Native Frame's authentication and authorization capabilities.

Authentication vs Authorization​

Before diving in, let's quickly distinguish between these two related but distinct concepts:

  • Authentication: Verifying the identity of a user (e.g. "Is this really the person they claim to be?")
  • Authorization: Determining what actions an authenticated user is allowed to perform (e.g. "Is this user allowed to broadcast?")

Native Frame provides flexible options for both, allowing you to implement auth flows that match your specific requirements.

Choosing Between JWT and Webhook-based Authentication​

Native Frame offers two main approaches for authentication: JWT-based and webhook-based. Each has its own advantages and use cases:

Performance Considerations

For scenarios where you need to optimize for performance, consider using webhook-based authentication. This approach allows you to use shorter tokens in the URL instead of requiring an Authorization header, which can be beneficial in certain situations.

JWT-based Authentication​

Pros:

  • Stateless and self-contained
  • Can include rich claim information
  • Well-suited for distributed systems

Cons:

  • Requires CORS requests for JSON or M3U8 manifest requests, which can impact performance
  • Tokens can become large, especially with many claims

Best for:

  • Applications with complex authorization requirements
  • Scenarios where you need to include detailed user information in the token

Webhook-based Authentication​

Pros:

  • Can use shorter tokens in the URL, potentially improving performance
  • Allows for real-time authorization checks
  • Flexible token format

Cons:

  • Requires your server to handle authentication requests
  • Potential for increased latency due to additional server requests

Best for:

  • High-performance scenarios where minimizing request overhead is crucial
  • Applications that need real-time or dynamic authorization checks
Security Consideration

When using webhook-based authentication with tokens in the URL, be aware that these tokens will not be encrypted in SSL/TLS requests. While the entire URL is encrypted during transmission, it may be visible in server logs or browser history. Always use short-lived tokens and avoid including sensitive information directly in the token.

Choose the authentication method that best fits your application's needs, considering factors such as performance requirements, security considerations, and the complexity of your authorization logic.

Authorization​

Native Frame offers granular authorization controls, allowing you to define precisely who can broadcast and view streams. This is perfect for implementing tiered access for content - perhaps offering exclusive feeds only to premium subscribers.

Broadcast Authorization​

When a user attempts to start a broadcast, Native Frame will check:

  1. Is their auth token valid?
  2. Does it have the "broadcaster" scope?

Viewer Authorization​

For viewers, you have two main options:

  1. Token-based: Similar to broadcast auth, but using tokens with a "viewer" scope. Good for pay-per-view content.
Note

The token is validated by Native Frame without additional callbacks to your end point thus, it is more efficient however it can only be issued once and is valid for limited amount of time

  1. Webhook-based: Native Frame calls your server to check viewer authorization in real-time. Ideal for subscription models where access might change mid-stream.
Note

The frequent callbacks may overload your backend plus may add latency for serving live streams. In order to mitigate the side effects the Native Frame server uses batching plus caching, which are both configurable