<commit_before>.. _securingapps:

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Securing Kurento Applications
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

[TODO full review]

Starting with Chrome 47, WebRTC is only allowed from SECURE ORIGINS (HTTPS or
localhost). Check their
`release notes <https://groups.google.com/forum/#!topic/discuss-webrtc/sq5CVmY69sc>`__
for further information about this issue.

.. note::

      Keep in mind that serving your application through HTTPS, forces you to use WebSockets Secure (WSS) if you are using websockets to control your application server.

Securing client applications
============================

.. _features-security-java-https:

Configure Java applications to use HTTPS
----------------------------------------


* The application needs a certificate in order to enable HTTPS:

   * Request a certificate from a local certification authority.

   * Create an self-signed certificate.

      .. sourcecode:: bash

         keytool -genkey -keyalg RSA -alias selfsigned -keystore \
         keystore.jks -storepass password -validity 360 -keysize 2048

* Use the certificate in your application:

     * Include a valid keystore in the *jar* file:

        File *keystore.jks* must be in the project's root path, and a
        file named *application.properties* must exist in
        *src/main/resources/*, with the following content:

         .. sourcecode:: bash

            server.port: 8443
            server.ssl.key-store: keystore.jks
            server.ssl.key-store-password: <PASSWORD>
            server.ssl.keyStoreType: JKS
            server.ssl.keyAlias: yourKeyAlias

      * You can also specify the location of the properties file. When
        launching your Spring-Boot based app, issue the flag
        ``-Dspring.config.location=<path-to-properties>`` .

* Start application

.. sourcecode:: bash

   mvn -U clean spring-boot:run -Dkms.url=ws://kms_host:kms_port/kurento

.. note::

      If you plan on using a webserver as proxy, like Nginx or Apache, you'll need to ``setAllowedOrigins`` when registering the handler. Please read the `official Spring documentation <https://docs.spring.io/spring/docs/current/spring-framework-reference/web.html#websocket-server-allowed-origins>`__ entry for more info.



Configure Node applications to use HTTPS
----------------------------------------

* The application requires a valid SSL certificate in order to enable HTTPS:

   * Request a certificate from a local certification authority.

   * Create your own self-signed certificate as explained
     `here <https://www.akadia.com/services/ssh_test_certificate.html>`__. This
     will show you how to create the required files: *server.crt*, *server.key*
     and *server.csr*.

Add the following changes to *server.js* in order to enable HTTPS:

.. sourcecode:: javascript

   ...<commit_msg>security: Small corrections in section titles<commit_after>.. _securingapps:

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Securing Kurento Applications
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

[TODO full review]

Starting with Chrome 47, WebRTC is only allowed from SECURE ORIGINS (HTTPS or
localhost). Check their
`release notes <https://groups.google.com/forum/#!topic/discuss-webrtc/sq5CVmY69sc>`__
for further information about this issue.

.. note::

      Keep in mind that serving your application through HTTPS, forces you to use WebSockets Secure (WSS) if you are using websockets to control your application server.

Securing Application Servers
============================

.. _features-security-java-https:

Configure a Java server to use HTTPS
------------------------------------


* The application needs a certificate in order to enable HTTPS:

   * Request a certificate from a local certification authority.

   * Create an self-signed certificate.

      .. sourcecode:: bash

         keytool -genkey -keyalg RSA -alias selfsigned -keystore \
         keystore.jks -storepass password -validity 360 -keysize 2048

* Use the certificate in your application:

     * Include a valid keystore in the *jar* file:

        File *keystore.jks* must be in the project's root path, and a
        file named *application.properties* must exist in
        *src/main/resources/*, with the following content:

         .. sourcecode:: bash

            server.port: 8443
            server.ssl.key-store: keystore.jks
            server.ssl.key-store-password: <PASSWORD>
            server.ssl.keyStoreType: JKS
            server.ssl.keyAlias: yourKeyAlias

      * You can also specify the location of the properties file. When
        launching your Spring-Boot based app, issue the flag
        ``-Dspring.config.location=<path-to-properties>`` .

* Start application

.. sourcecode:: bash

   mvn -U clean spring-boot:run -Dkms.url=ws://kms_host:kms_port/kurento

.. note::

      If you plan on using a webserver as proxy, like Nginx or Apache, you'll need to ``setAllowedOrigins`` when registering the handler. Please read the `official Spring documentation <https://docs.spring.io/spring/docs/current/spring-framework-reference/web.html#websocket-server-allowed-origins>`__ entry for more info.



Configure a Node server to use HTTPS
------------------------------------

* The application requires a valid SSL certificate in order to enable HTTPS:

   * Request a certificate from a local certification authority.

   * Create your own self-signed certificate as explained
     `here <https://www.akadia.com/services/ssh_test_certificate.html>`__. This
     will show you how to create the required files: *server.crt*, *server.key*
     and *server.csr*.

Add the following changes to *server.js* in order to enable HTTPS:

.. sourcecode:: javascript

   ...
{'fraction_non_alphanumeric': 0.1332982086406744, 'fraction_numerical': 0.005619950825430277, 'mean_word_length': 2.965877437325905, 'pattern_counts': {'":': 0, '<': 13, '<?xml version=': 0, '>': 13, 'https://': 6, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5368376', 'n_tokens_mistral': 1602, 'n_tokens_neox': 1479, 'n_words': 567}