Help me understand risks of exposing janus to the internet

General
1

I noticed that the “easy” way of deploying webapp access (via reverse proxy) basically exposes the entire REST API to the internet. I am wondering if this is something people generally do, or if it is only intended for demos.

I am considering using the VideoRoom plugin for a simple private video conferencing service. I managed to modify the videoroom (multistream) demo to support pin access control to the room, but now I’m wondering if I have to manually secure each plugin.

I did scan the FAQ and list of presentations, but didn’t find the right documentation / hints.

2

Janus has a basic auth mechanism, but what most (us included) do is implement wrappers/intermediaries, as in a server from where you send Janus API requests, and expose a custom API to clients. This allows you to use Janus as a media server you control yourself, thus limiting what people can do to what you expose. There’s a few libraries in different languages, we personally use our own Janode which is a Node.js SDK.