Software Notes

▪ User authentication is done using JSON Web Tokens (JWTs) that are verified by server on each request

▪ JWTs are digitally signed using HMAC SHA-256 to prevent forging

▪ JWTs come with short expiration dates and need to be refreshed regularly during a user session.

▪ JWTs are required for all secured server queries

▪ API calls are limited by user role authorization; user clients without proper roles cannot attempt API calls

▪ No Trust” policy with user interface code; back-end servers do not depend on client for any security ▪ WebRTC calls are encrypted on an end-to-end level