Enhance signaling server validation

Oct 13, 2025 by wbrum.org 32 views

Introduction

In this article, we will discuss a common issue that can occur in WebRTC-based applications, specifically when it comes to subscriber candidates. We will explore the problem, its causes, and potential solutions.

The Problem

A customer of the HPB service reported issues with some participants in a larger call that could not subscribe to the streams of some publishers. After checking the logs of the signaling server, we noticed error messages about Candidate message sid (12345) does not match publisher sid (67890).

Understanding the Issue

The sid values in Talk are generated from the client's timestamp. In the log, the first timestamp matches the time when a subscriber was created in the affected session, while the second timestamp matches the time when the publisher of the session was created. This suggests that the client sent the candidate for the subscriber stream with the sid of the own publisher.

Analyzing the Logs

Let's take a closer look at the relevant log messages of the signaling server:

Mar 10 20:01:51 sig-server nextcloud-spreed-signaling[32462]: clientsession.go:505: Session c2badVMZJVhHp3AKvgQWTJnIcRl94GdM7AZqrbSODAJ8PTBhdmo1REhwcXI2dl9MeUlYVDF6Yl9IcDFVT0ZWWC1YM094QnBzXzBwc0h3WjU4QlFjcmU4V2h8MDQyMzM2MTQ3MQ== left call 5uzk4jec
Mar 10 20:02:04 sig-server nextcloud-spreed-signaling[32462]: mcu_proxy.go:1172: Created video publisher 7627d347-41a9-470b-a812-0460ceef7487 on https://proxy1.domain.invalid/ for c2badVMZJVhHp3AKvgQWTJnIcRl94GdM7AZqrbSODAJ8PTBhdmo1REhwcXI2dl9MeUlYVDF6Yl9IcDFVT0ZWWC1YM094QnBzXzBwc0h3WjU4QlFjcmU4V2h8MDQyMzM2MTQ3MQ==
Mar 10 20:02:04 sig-server nextcloud-spreed-signaling[32462]: clientsession.go:946: Publishing video as 7627d347-41a9-470b-a812-0460ceef7487 for session c2badVMZJVhHp3AKvgQWTJnIcRl94GdM7AZqrbSODAJ8PTBhdmo1REhwcXI2dl9MeUlYVDF6Yl9IcDFVT0ZWWC1YM094QnBzXzBwc0h3WjU4QlFjcmU4V2h8MDQyMzM2MTQ3MQ==
Mar 10 20:02:04 sig-server nextcloud-spreed-signaling[32462]: room.go:789: Session c2badVMZJVhHp3AKvgQWTJnIcRl94GdM7AZqrbSODAJ8PTBhdmo1REhwcXI2dl9MeUlYVDF6Yl9IcDFVT0ZWWC1YM094QnBzXzBwc0h3WjU4QlFjcmU4V2h8MDQyMzM2MTQ3MQ== joined call 5uzk4jec

...

Mar 10 20:35:33 sig-server nextcloud-spreed-signaling[32462]: hub.go:1211: Resume session from 1.2.3.4 in DE (Mozilla/
5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0) c2badVMZJVhHp3AKvgQWTJnIcRl94GdM7AZqrbSODAJ8PTB
hdmo1REhwcXI2dl9MeUlYVDF6Yl9IcDFVT0ZWWC1YM094QnBzXzBwc0h3WjU4QlFjcmU4V2h8MDQyMzM2MTQ3MQ== (private=resume-session-id)

...

Mar 10 20:35:34 sig-server nextcloud-spreed-signaling[32462]: clientsession.go:1024: Subscribing video from rtZ4nuxmNBQxoQyibWySkDwHnE0aeveVkPZOa2Ptm1x8PThnMU9RWE4xZWtKeGMwR2RWeWMzU25ZRC1NN3lyVFAyLThucFlLQ3JTR2QzN0xGUzZJci1Db2F8MzMzNTM2MTQ3MQ== as ee0de55d-85b6-45fa-9ce2-e89e8f645124 in session c2badVMZJVhHp3AKvgQWTJnIcRl94GdM7AZqrbSODAJ8PTBhdmo1REhwcXI2dl9MeUlYVDF6Yl9IcDFVT0ZWWC1YM094QnBzXzBwc0h3WjU4QlFjcmU4V2h8MDQyMzM2MTQ3MQ==

...
more subscribers to other sessions from c2badV...
...

Mar 10 20:35:35 sig-server nextcloud-spreed-signaling[32462]: hub.go:2673: Could not send MCU message &{Type:candidate Sid:1741635334707 RoomType:video Payload:map[candidate:map[candidate:candidate:0 1 UDP 2122252543 192.168.0.101 51661 typ host sdpMLineIndex:0 sdpMid:0]] Bitrate:0 AudioCodec: VideoCodec: VP9Profile: H264Profile: offerSdp:<nil> answerSdp:<nil>} for session c2badVMZJVhHp3AKvgQWTJnIcRl94GdM7AZqrbSODAJ8PTBhdmo1REhwcXI2dl9MeUlYVDF6Yl9IcDFVT0ZWWC1YM094QnBzXzBwc0h3WjU4QlFjcmU4V2h8MDQyMzM2MTQ3MQ== to c2badVMZJVhHp3AKvgQWTJnIcRl94GdM7AZqrbSODAJ8PTBhdmo1REhwcXI2dl9MeUlYVDF6Yl9IcDFVT0ZWWC1YM094QnBzXzBwc0h3WjU4QlFjcmU4V2h8MDQyMzM2MTQ3MQ==: Candidate message sid (1741635334707) does not match publisher sid (1741633324390)

...

1741635334707 -> Mar 10 20:35:34
1741633324390 -> Mar 10 20:02:04

Possible Causes

Based on the logs, it appears that the client sent the candidate for the subscriber stream with the sid of the own publisher. This could be due to a few reasons:

The client is not properly handling the session state, leading to incorrect sid values.
The signaling server is not correctly validating the sid values, allowing incorrect candidates to be sent.
There is a bug in the client or server code that is causing the incorrect sid values.

Potential Solutions

To resolve this issue, we can try the following:

Improve client-side session state handling: Ensure that the client is properly handling the session state, including the sid values.
Enhance signaling server validation: Implement additional validation on the signaling server to ensure that the sid values are correct before sending candidates.
Fix client or server code bug: Identify and fix any bugs in the client or server code that may be causing the incorrect sid values.

Conclusion

In conclusion, the issue of wrong sid values in subscriber candidates is a complex problem that requires a thorough analysis of the client and server code. By understanding the possible causes and implementing potential solutions, we can resolve this issue and ensure that our WebRTC-based application functions correctly.

Recommendations

Based on our analysis, we recommend the following:

Improve client-side session state handling: Ensure that the client is properly handling the session state, including the sid values.
Enhance signaling server validation: Implement additional validation on the signaling server to ensure that the sid values are correct before sending candidates.
Fix client or server code bug: Identify and fix any bugs in the client or server code that may be causing the incorrect sid values.

Q: What is the issue with the "sid" values in subscriber candidates?

A: The issue is that the client is sending the candidate for the subscriber stream with the sid of the own publisher, instead of the correct sid for the subscriber.

Q: Why is this happening?

A: This could be due to a few reasons, including:

The client is not properly handling the session state, leading to incorrect sid values.
The signaling server is not correctly validating the sid values, allowing incorrect candidates to be sent.
There is a bug in the client or server code that is causing the incorrect sid values.

Q: How can I improve client-side session state handling?

A: To improve client-side session state handling, you can:

Ensure that the client is properly handling the session state, including the sid values.
Implement additional validation on the client-side to ensure that the sid values are correct before sending candidates.
Fix any bugs in the client code that may be causing the incorrect sid values.

Q: How can I enhance signaling server validation?

A: To enhance signaling server validation, you can:

Implement additional validation on the signaling server to ensure that the sid values are correct before sending candidates.
Use a more robust validation mechanism, such as a checksum or digital signature, to ensure that the sid values are correct.
Fix any bugs in the server code that may be causing the incorrect sid values.

Q: What are some potential solutions to this issue?

A: Some potential solutions to this issue include:

Improving client-side session state handling.
Enhancing signaling server validation.
Fixing client or server code bugs.
Implementing additional error handling and logging to help diagnose the issue.

Q: How can I troubleshoot this issue?

A: To troubleshoot this issue, you can:

Review the client and server logs to identify any errors or issues.
Use debugging tools to step through the client and server code and identify the source of the issue.
Test the client and server code in isolation to identify any issues.
Collaborate with other developers to identify and fix the issue.

Q: What are some best practices for handling "sid" values in subscriber candidates?

A: Some best practices for handling sid values in subscriber candidates include:

Ensuring that the client and server code are properly handling the session state, including the sid values.
Implementing additional validation on the client and server sides to ensure that the sid values are correct.
Fixing any bugs in the client and server code that may be causing the incorrect sid values.
Implementing additional error handling and logging to help diagnose any issues.

Q: How can I prevent this issue from happening in the future?

A: To prevent this issue from happening in the future, you can:

Implement additional validation on the client and server sides to ensure that the sid values are correct.
Fix any bugs in the client and server code that may be causing the incorrect sid values.
Implement additional error handling and logging to help diagnose any issues.
Regularly review and test the client and server code to ensure that it is functioning correctly.