I’m playing around with nginx-rtmp module (here’s a more active fork) and I’m wondering what is the correct way of restricting access to it?

I imagined a flow like this:

1. a user connects to a socket (phoenix) with a token
2. Phoenix.Token verifies the user’s id
3. user is fetched from the database and assigned to the socket
4. some time later the user can join a channel like user:#{user_id} and if user_id is the same as user.id stored in assigns, this user becomes the broadcaster for this channel and receives a link to where to push his/her rtmp stream.
5. at this point I start having troubles, how would I verify on nginx side that the stream coming to it is actually from the broadcaster and not some cracked cctv? how would I also forbid any “naughty” rtmp stream to an url that has not been received from user:#{user_id} channel?

I was thinking maybe jwt but I am not sure since I haven’t had any experience with them.

I guess what I am asking is, how something like this generally works?

Should I keep all the rtmp links that have been sent from the channel in some kind of registry and redirect the first rtmp push to nginx-rtmp through this registry which would put an “authorisation” header in the request, so that nginx-rtmp would then check it?