Software Notes

User authentication is done using JSON Web Tokens (JWTs) that are verified by server on each request
JWTs are digitally signed using HMAC SHA-256 to prevent forging
JWTs come with short expiration dates and need to be refreshed regularly during a user session.
JWTs are required for all secured server queries
API calls are limited by user role authorization; user clients without proper roles cannot attempt API calls
No Trust” policy with user interface code; back-end servers do not depend on client for any security
WebRTC calls are encrypted on an end-to-end level

FAQs