Flash Media Server: How to fully protect stream? -

i developing lightweight protection mechanism on fms. currently, can authenticate user using sso token provided main server. however, authenticating sso token requires webservice/remoteobject of server, expensive , unrealistic large number of concurrent users. hence, created session each validated user, returned session id user , user can use further connections.

what have concern in solution session hijacking attack. imposter can use session id stream, if sniffed customer's request. prevent this, have 2 solutions: first, every client create 2 connections server, 1 ssl control message (e.g. netconnection.call function), 1 streaming data. other creating secured rtmpe channel stream. both require more processing power implement (15% more latter, don't know how former).

is there better solution problem?

there's no way can prevent session token being hijacked without communication between fms , sso server.

the least create single use token when client goes through sso side, store it, , when player connects fms invalidate token. use redis+nginx setup handle tokens, make sso store them there , write plugin on fms expire them instead of using webservices or remoteobjects.

happy coding! 8)