For applications that want to limit the playback of streams per user or only want to provide access to streams with a given name, the interface IStreamPlaybackSecurity http://dl.fancycode.com/red5/api/org/red5/server/api/stream/IStreamPlaybackSecurity.html is available in Red5.

It can be implemented by any object and registered in the ApplicationAdapter http://dl.fancycode.com/red5/api/org/red5/server/adapter/ApplicationAdapter.html . An arbitrary number of stream security handlers is supported per application. If at least one of the handlers denies access to the stream, the client receives an error NetStream.Failed with a description field giving a corresponding error message.

An example handler that only allows access to streams that have a name starting with liveStream is described below:

import org.red5.server.api.IScope; 
import org.red5.server.api.stream.IStreamPlaybackSecurity; 
            
public class NamePlaybackSecurity implements IStreamPlaybackSecurity { 
            
    public boolean isPlaybackAllowed(IScope scope, String name, int start, 
     int length, boolean flushPlaylist) { 
         if (!name.startswith("liveStream")) { 
            return false; 
         } else { 
            return true; 
         } 
     };             
} 

To register this handler in the application, add the following code in the appStart method:

registerStreamPlaybackSecurity(new NamePlaybackSecurity()); 

Red5 includes a sample security handler that denies all access to streams (DenyAllStreamAccess http://dl.fancycode.com/red5/api/org/red5/server/api/stream/support/DenyAllStreamAccess.html).

In most applications that allow the user to publish and/or record streams, this access must be limited to prevent the server from being misused. Therefore, Red5 provides the interface IStreamPublishSecurity http://dl.fancycode.com/red5/api/org/red5/server/api/stream/IStreamPublishSecurity.html to deny publishing of certain streams.

Similar to IStreamPlaybackSecurity http://dl.fancycode.com/red5/api/org/red5/server/api/stream/IStreamPlaybackSecurity.html, it can be implemented by any object and registered in the ApplicationAdapter http://dl.fancycode.com/red5/api/org/red5/server/adapter/ApplicationAdapter.html. If one of the registered handlers denies access, the client receives an error NetStream.Failed with a description field giving a corresponding error message.

An example handler that only allows authenticated connections to publish a live stream starting with liveStream and deny all other access is described below: