MERFi Support Hub
Software Notes
- User authentication is done using JSON Web Tokens (JWTs) that are verified by server on each request
- JWTs are digitally signed using HMAC SHA-256 to prevent forging
- JWTs come with short expiration dates and need to be refreshed regularly during a user session
- JWTs are required for all secured server queries
- API calls are limited by user role authorization; user clients without proper roles cannot attempt API calls
- “No Trust” policy with user interface code; back-end servers do not depend on client for any security
- WebRTC calls are encrypted on an end-to-end level
