WebRTC is an open standard specification for real time communications embedded in web browsers. It is also a modern media engine implementation with a documented and standardized Javascript API layer.

Unlike earlier VoIP (Voice over IP) protocols, WebRTC takes a security first approach. There are two main reasons for this:

1. WebRTC is newer. It started life at a point in time where the whole internet started migrating towards a security first approach. Earlier VoIP protocols were defined before that concept took shape
2. The browser. WebRTC resides in a browser, where the execution environment itself brings with it an additional set of attack vectors and vulnerabilities that had to be addressed

As a protocol stack, we can depict WebRTC as this diagram:

The red highlights are added to indicate and emphasize where security and privacy aspects of this stack reside. On the left hand side (signaling), encryption by way of TLS is enforced on all connections that may be used to send and receive WebRTC related signaling messages. On the right hand side, SRTP and DTLS are used to make sure that real time audio, video and data are all encrypted in transit (when sent and received).

This is one aspect of security employed by WebRTC, but the one easiest to explain and illustrate. Other areas posing security challenges include media server implementation, application logic and human interaction (such as device permissions, screen sharing and automated answering of call requests).

The next chapters each cover a specific aspect of security in WebRTC. We will dive deeper into each, understanding the threats posed as well as the solutions created and needed. Where applicable, we will offer best practices and guidelines you should take to improve the security of your WebRTC application.

In these chapters, we will touch the following domains:

1. Security mechanisms in WebRTC - what comes “out of the box” with WebRTC, and how that assists in securing your service
2. Signaling - reviewing signaling protocols and mechanisms that can weaken security of WebRTC applications
3. Media - where media processing and security meet, there is a need of specific implementations, left out of the standard specification of WebRTC
4. Clients - where users handle their interactions with your service, and where most of the immediate and common attack vectors are found today
5. UX/UI - how the user experience and user interaction you pour into your service affect the security and privacy of your users
6. E2EE - End-to-end encryption, the latest advancement in securing conversations, and how it gets implemented on top of WebRTC