why exposing streamKey?

[hofarah]

Description

In Readme example, your stream key must be in URL to receive stream.
I don't want to expose my stream key. for example my final URL for receive stream include hash of my stream key

Normal Senario

push configs

• Service: Custom
• Server: rtmp://localhost/live
• Stream Key: livestream

stream configs

play an RTMP stream with URL `rtmp://localhost/live/livestream
so If someone see my stream key , they can display anything they want to users.

Expect

push configs

• Service: Custom
• Server: rtmp://localhost/live
• Stream Key: livestream

stream configs

play an RTMP stream with URL rtmp://localhost/live/{{hash of "livestream"}}

[winlinvip]

The name 'StreamKey' is a mistake made by OBS, it is actually 'StreamName'. If there is authentication information, it is 'StreamNameWithKey'.

If there is no authentication information, it is 'StreamName'. Both streaming and playback are the same, for example, the following 'StreamName' is 'livestream':

Publish: rtmp://localhost/live/livestream
Play: rtmp://localhost/live/livestream
Play: http://localhost:8080/live/livestream.m3u8
Play: webrtc://localhost/live/livestream

Note: For OBS, the Server is rtmp://localhost/live, the StreamKey is livestream.

If there is authentication information, it is usually passed in a similar way to HTTP's QueryString. For example, the following 'StreamName' is 'livestream', and 'Key' is 'mysecret':

publish: rtmp://localhost/live/livestream?key=mysecret
Play: rtmp://localhost/live/livestream
Play: http://localhost:8080/live/livestream.m3u8
Play: webrtc://localhost/live/livestream

Note: For OBS, the Server is rtmp://localhost/live, the StreamKey is livestream?key=mysecret.

At this point, when playing the stream, the key parameter information is not visible. This logic is the same as creating a resource using HTTP POST and obtaining a resource using HTTP GET.

How to implement authentication? SRS will use HTTP Callback to send both StreamName and Key to your business server. For more details, you can refer to Authentication.

In summary: This StreamKey from OBS has misled quite a few people. When lies and mistakes are repeated a thousand times, they become the truth, and the actual truth seems like a lie.

TRANS_BY_GPT4