Remove token openvidu

Issues developing apps
1

hi

i get token (role:publisher) for specific user that can publish but the problem is when he want generate token, the app delete other connection but if he dosent connect to session and generate another token, he has two token and can connect with two token and can publish two times!
how can i solve this problem?
is any way that i can remove other token?

thanks

2

@pabloFuente
@CSantosM
@cruizba

3

I don’t understand your problem.

You’re developing your own app logic. Why do you want generating two tokens and remove one instead generate only one token?

4

I dont want generating 2 tokens
I want each user has one token
I mean if i create token for one user he can disable his javascript and dont connect to session
Now if the user send request again the app give him another token.
Now the user can connect to session two times
I want in the moment each user can connect one time to session

5

@CSantosM is right, you should use your back-end to detect when an user requests a new token without consuming the previous one.

I don’t think this should be done in the OpenVidu server, maybe I want multiple tokens. :slight_smile:

6

In the backend i check if the previous token has in connections of the session (with openvidu api) , i delete that connection
But i cant undrestand the user connected with previous token. Maybe he took the token and didnt connect to session (disable javascript).
Now he can connect with previous token too.

7

I understand now, you are correct (I’ve looked in the server source code) with the fact that the token is consumed only when you join the room (or publish an IPCAM).

I guess that you could save the last generated token for that user in the back-end. Then do a call to your back-end before joining the room and check if the token is the last for that user. Based on your back-end response you can continue joining the room or throw an error.

Of course this is not perfectly secure and it could also be bypassed by messing up with the Javascript by a clever user.

Or you could try something else: add a webhook on participantJoined event, save in the back-end that the user is connected, then on another join by the same participant terminate one of the connections. Don’t forget to remove that user status on participantLeft.

1 Like
8

use webhook is a good idea
thanks