RFC 8828

WebRTC IP Address Handling Requirements

📅 published January 2021, from ietf

1. Introduction ✨

Okay so, bestie, let's talk about the RFC title block first 💖 This is RFC 8828, "WebRTC IP Address Handling Requirements" 🎀 It's a Standards Track doc from the IETF, written by J. Uberti and G. Shieh over at Google, dated January 2021 🌸 It's published under ISSN 2070-1721. It doesn't obsolete or update any other RFCs, so it's its own little main character 👑

Abstract: this doc gives info and requirements on how IP addresses should be handled by Web Real-Time Communication (WebRTC) implementations 🦋

Now the Status of This Memo and Copyright bits, which are the boring-but-important legal stuff 💅 It's an Internet Standards Track document, a product of the IETF, with IETF consensus, public review, and IESG approval. Info on its status, errata, and feedback lives at https://www.rfc-editor.org/info/rfc8828 🧚

The copyright is Copyright (c) 2021 IETF Trust and the document authors, all rights reserved 🔒 It's subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as of the publication date. Code extracted from it must include Simplified BSD License text (Section 4.e of the Trust Legal Provisions) and comes with no warranty 💜

Table of Contents 🍓

1.  Introduction
2.  Terminology
3.  Problem Statement
4.  Goals
5.  Detailed Design
  5.1.  Principles
  5.2.  Modes and Recommendations
6.  Implementation Guidance
  6.1.  Ensuring Normal Routing
  6.2.  Determining Associated Local Addresses
7.  Application Guidance
8.  Security Considerations
9.  IANA Considerations
10. References
  10.1.  Normative References
  10.2.  Informative References
Acknowledgements
Authors' Addresses

1.1. Opening the Vibe 🦋

Okay so one of WebRTC's key features is peer-to-peer connections 🫶 But when it sets one up, which means trying connections from a bunch of different IP addresses, WebRTC can let a web app learn more about the user than an app just using the Hypertext Transfer Protocol (HTTP) [RFC7230] would. That can be a problem in some cases 😭 This doc sums up the concerns and gives recommendations on how WebRTC implementations should handle the trade-off between privacy and media performance ✨

2. Terminology 💅

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. 🙈

3. Problem Statement 🔥

Okay so, to set up a peer-to-peer connection, WebRTC implementations use Interactive Connectivity Establishment (ICE) [RFC8445] 💖 ICE tries to find multiple IP addresses using stuff like Session Traversal Utilities for NAT (STUN) [RFC5389] and Traversal Using Relays around NAT (TURN) [RFC5766]. Then it checks the connectivity of each local-address-remote-address pair to pick the best one ✨ The addresses it collects are usually an endpoint's private physical or virtual addresses plus its public Internet addresses 🌈

Those addresses get handed to the web app so they can be sent to the remote endpoint for its checks 🧚 This means the app can learn way more about the local network setup than it would in a typical HTTP situation, where the web server only sees one public Internet address, i.e., the address the HTTP request came from 👀

The extra info falls into three categories, bestie 🎀

If the client is multihomed, extra public IP addresses for the client can be learned 🦋 Like, if the client tries to hide its physical location through a Virtual Private Network (VPN), and the VPN and local OS support routing over multiple interfaces (a "split-tunnel" VPN), WebRTC can find not only the public address for the VPN, but also the ISP public address the VPN runs over 😭
If the client is behind a Network Address Translator (NAT), the client's private IP addresses, often [RFC1918] addresses, can be learned 🌸
If the client is behind a proxy (a client-configured "classical application proxy", as defined in [RFC1919], Section 3), but direct access to the Internet is permitted, WebRTC's STUN checks will bypass the proxy and reveal the client's public IP address 💅 This also applies to the "enterprise TURN server" scenario described in [RFC7478], Section 2.3.5.1 if, as above, direct Internet access is permitted 🙈 Just know that when this doc says "proxy," it always means an [RFC1919] proxy server 🍓

Of these three, the first is the most significant, because for some users the whole point of a VPN is anonymity 🔒 But different VPN users have different needs, and some (like corporate VPN users) may actually prefer WebRTC to send media traffic directly, i.e., not through the VPN 💜

The second is less significant but still valid 🙈 The core issue is that web apps can learn about addresses that aren't exposed to the Internet. Typically these are IPv4, but they can also be IPv6, like with NAT64 [RFC6146] 🧚 Disclosure of the [RFC4941] IPv6 addresses recommended by [RFC8835] is pretty benign because they have intentionally short lifetimes 💖 IPv4 addresses are trickier, though 😭 Private IPv4 addresses often have minimal entropy (e.g., 192.168.0.2, a fairly common address), but in the worst case they can have 24 bits of entropy with an indefinite lifetime 💀 So they can be a pretty significant fingerprinting surface 🔥 On top of that, intranet web sites can be attacked more easily when their IPv4 address range is known externally 👑

Private IP addresses can also act as an identifier that lets web apps running in isolated browsing contexts (e.g., normal and private browsing) figure out they're on the same device 🦋 That could let app sessions get correlated, which defeats some of the privacy protections isolation provides ✨ Private addresses are just one possible mechanism for this correlation, and this is an area for further study 🌈

The third concern is the least common 🌸 Proxy admins can already control this behavior through organizational firewall policy, and forcing WebRTC traffic through a proxy server generally hurts both the proxy and media quality 💅

Also, these concerns predate WebRTC! 😭 Adobe Flash Player offered similar functionality since it added Real-Time Media Flow Protocol (RTMFP) support [RFC7016] in 2008 🧚

4. Goals 🎀

WebRTC's support of secure peer-to-peer connections helps make decentralized systems possible, which can have privacy benefits 🫶 So blunt fixes that disable WebRTC or make it way harder to use are undesirable 🙅‍♀️ This doc takes a more nuanced approach, with these goals:

Provide a framework for understanding the problem so controls might be provided to make different trade-offs between performance and privacy concerns with WebRTC 💖
Using that framework, define settings that enable peer-to-peer communications, each with a different balance between performance and privacy 🦋
Finally, provide recommendations for default settings that give reasonable performance without exposing addressing information in a way that might violate user expectations 👑

5. Detailed Design ✨

5.1. Principles 🌈

Okay so here are the key principles for our framework 💅

By default, WebRTC traffic should follow typical IP routing (i.e., WebRTC should use the same interface used for HTTP traffic), and only the system's 'typical' public addresses (or those of an enterprise TURN server, if present) should be visible to the application 🧚 But for optimal media quality, it should be possible to enable WebRTC to use all network interfaces to find the ideal route 🔥
By default, WebRTC should be able to negotiate direct peer-to-peer connections between endpoints (i.e., without traversing a NAT or relay server) when such connections are possible 🌸 This makes sure apps that need true peer-to-peer routing for bandwidth or latency reasons can work 💜
It should be possible to configure WebRTC to not disclose private local IP addresses, to avoid the issues with web apps learning those addresses 🙈 This document does not require this to be the default state, because there's no currently defined mechanism that can satisfy this requirement as well as the earlier requirement to allow direct peer-to-peer connections 😭
By default, WebRTC traffic should not be sent through proxy servers 🍓 That's because of the media-quality problems with sending WebRTC traffic over TCP (which is almost always used when talking to such proxies), plus proxy performance issues from proxying WebRTC's long-lived, high-bandwidth connections 🔒 Still, it should be possible to force WebRTC to send its traffic through a configured proxy if desired 🦋

Part 1 is done, bestie! 🎀 More parts are coming, so stay tuned 💖

5.2. Modes and Recommendations ✨

okay so based on all those ideas, we get four specific modes of WebRTC behavior 🎀. they're different trade-offs between media quality and privacy, so you pick your fighter:

Mode 1 - Enumerate all addresses 🔥: WebRTC MUST use all network interfaces to attempt communication with STUN servers, TURN servers, or peers. this converges on the best media path and is ideal when media performance is the top priority, but it discloses the most information 😬
Mode 2 - Default route + associated local addresses 🦋: WebRTC MUST follow the kernel routing table rules, which will typically cause media packets to take the same route as the application's HTTP traffic. if an enterprise TURN server is present, the preferred route MUST be through this TURN server. once an interface has been chosen, the private IPv4 and IPv6 addresses associated with this interface MUST be discovered and provided to the application as host candidates. this ensures direct connections can still be established in this mode 💖
Mode 3 - Default route only 🌸: this is the same as Mode 2, except the associated private addresses MUST NOT be provided. the only IP addresses gathered are the ones discovered via mechanisms like STUN and TURN (on the default route). this may cause traffic to hairpin through a NAT, fall back to an application TURN server, or fail altogether, with resulting quality implications 💀
Mode 4 - Force proxy 🧚: this is the same as Mode 3, but when the application's HTTP traffic is sent through a proxy, WebRTC media traffic MUST also be proxied. if the proxy doesn't support UDP (which is the case for all HTTP and most SOCKS [RFC1928] proxies), or the WebRTC implementation doesn't support UDP proxying, UDP gets disabled and TCP is used to send and receive media through the proxy. TCP means reduced media quality, on top of the performance considerations of sending all WebRTC media through the proxy server 🥺

okay now the consent part, this one is important bestie 🫶 Mode 1 MUST NOT be used unless user consent has been provided. the details of that consent are left up to the implementation. one potential mechanism is tying it to getUserMedia (device permissions) consent, described in [RFC8827], Section 6.2. or, implementations can provide their own specific mechanism to get user consent 💜

when user consent hasn't been obtained, Mode 2 SHOULD be used. 🌈

these defaults are a reasonable trade-off. trusted WebRTC apps get to achieve optimal network performance, but apps without consent (like 1-way streaming or data-channel apps) only get the minimum information needed to make direct connections, as defined in Mode 2. implementations MAY choose stricter modes if desired, e.g., if a user indicates they want all WebRTC traffic to follow the default route 👑

future documents may define additional modes and/or update the recommended default modes. the plot continues 📖

and lowkey this one is clutch: the suggested defaults still work even for organizations that want all external WebRTC traffic to traverse a proxy or enterprise TURN server. they just set an organizational firewall policy that only lets WebRTC traffic leave through the proxy or TURN server. this makes sure the proxy or TURN server handles all external traffic, but still allows direct connections for intra-organization traffic (and, in the proxy case, dodges the performance issues of forcing media through said proxy) ✨🎀

6. Implementation Guidance 💅

this section gives WebRTC implementations some guidance on how to actually carry out the policies described above 🛠️

6.1. Ensuring Normal Routing 🛣️

when you're trying to follow typical IP routing (which Modes 2 and 3 need), the simplest move is to bind() the sockets used for peer-to-peer connections to the wildcard addresses (0.0.0.0 for IPv4, :: for IPv6). that lets the OS route WebRTC traffic the same way it routes HTTP traffic. STUN and TURN work as usual, and host candidates can still be determined as mentioned below 🦋

6.2. Determining Associated Local Addresses 🔍

when you bind to a wildcard address, you've got some extra work to figure out the associated local address Mode 2 needs. we define that as the source address that would be used for any packets sent to the web application host (assuming UDP and TCP get the same routing treatment). using the web-application host as the destination makes sure you pick the right source address, no matter where the application lives (like on an intranet, for example) 🧠

first, you grab the right remote IPv4/IPv6 address by resolving the host component of the web application URI [RFC3986]. if the client is behind a proxy and can't resolve those IPs via DNS, the proxy's address can be used instead. or, if the web application was loaded from a file:// URI [RFC8089] instead of over the network, the implementation can fall back to a well-known DNS name or IP address 🌍

once you've got a suitable remote IP, the implementation can create a UDP socket, bind() it to the appropriate wildcard address, and then connect() to the remote IP. usually this gets the socket assigned a local address based on the kernel routing table, and it doesn't send any packets over the network 🫧

finally, you can query the socket with getsockname() (or the equivalent) to find out the appropriate local address 🎯

7. Application Guidance 📱

heads up, the recommendations in this document might make certain WebRTC apps malfunction 😭 so if you want your app to be robust in every scenario, here are some guidelines:

Applications SHOULD deploy a TURN server with support for both UDP and TCP connections to the server. this makes sure connectivity can still be established even when Mode 3 or 4 is in use, assuming the TURN server can be reached 🫶
Applications SHOULD detect when they don't have access to the full set of ICE candidates by checking for the presence of host candidates. if no host candidates are present, Mode 3 or 4 is in use, and that knowledge can be useful for diagnostics 🔎

Wait, I need to fix that: the BCP 14 words should only appear where the original uses them, in capitals. The bullets above used bold caps on SHOULD, which is fine since the original uses SHOULD twice in this section. Here is the corrected version of that section, with the same content:

7. Application Guidance 📱

heads up, the recommendations in this document might make certain WebRTC apps malfunction 😭 so if you want your app to be robust in every scenario, here are some guidelines:

Applications SHOULD deploy a TURN server with support for both UDP and TCP connections to the server. this makes sure connectivity can still be established even when Mode 3 or 4 is in use, assuming the TURN server can be reached 🫶
Applications SHOULD detect when they don't have access to the full set of ICE candidates by checking for the presence of host candidates. if no host candidates are present, Mode 3 or 4 is in use, and that knowledge can be useful for diagnostics 🔎

8. Security Considerations 🔐

this document describes several potential privacy and security concerns associated with WebRTC peer-to-peer connections. it also provides mechanisms and recommendations for WebRTC implementations to address these concerns. this part is seriously important, so take it seriously 🚨

9. IANA Considerations 🌷

this document has no IANA actions. nothing to register, nothing to update, just vibes 🍓

10. References 📚

10.1. Normative References

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <https://www.rfc-editor.org/info/rfc2119>.

[RFC3986]  Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
           Resource Identifier (URI): Generic Syntax", STD 66,
           RFC 3986, DOI 10.17487/RFC3986, January 2005,
           <https://www.rfc-editor.org/info/rfc3986>.

[RFC5389]  Rosenberg, J., Mahy, R., Matthews, P., and D. Wing,
           "Session Traversal Utilities for NAT (STUN)", RFC 5389,
           DOI 10.17487/RFC5389, October 2008,
           <https://www.rfc-editor.org/info/rfc5389>.

[RFC5766]  Mahy, R., Matthews, P., and J. Rosenberg, "Traversal Using
           Relays around NAT (TURN): Relay Extensions to Session
           Traversal Utilities for NAT (STUN)", RFC 5766,
           DOI 10.17487/RFC5766, April 2010,
           <https://www.rfc-editor.org/info/rfc5766>.

[RFC8089]  Kerwin, M., "The "file" URI Scheme", RFC 8089,
           DOI 10.17487/RFC8089, February 2017,
           <https://www.rfc-editor.org/info/rfc8089>.

[RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
           2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
           May 2017, <https://www.rfc-editor.org/info/rfc8174>.

[RFC8445]  Keranen, A., Holmberg, C., and J. Rosenberg, "Interactive
           Connectivity Establishment (ICE): A Protocol for Network
           Address Translator (NAT) Traversal", RFC 8445,
           DOI 10.17487/RFC8445, July 2018,
           <https://www.rfc-editor.org/info/rfc8445>.

10.2. Informative References

[RFC1918]  Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G.
           J., and E. Lear, "Address Allocation for Private
           Internets", BCP 5, RFC 1918, DOI 10.17487/RFC1918,
           February 1996, <https://www.rfc-editor.org/info/rfc1918>.

[RFC1919]  Chatel, M., "Classical versus Transparent IP Proxies",
           RFC 1919, DOI 10.17487/RFC1919, March 1996,
           <https://www.rfc-editor.org/info/rfc1919>.

[RFC1928]  Leech, M., Ganis, M., Lee, Y., Kuris, R., Koblas, D., and
           L. Jones, "SOCKS Protocol Version 5", RFC 1928,
           DOI 10.17487/RFC1928, March 1996,
           <https://www.rfc-editor.org/info/rfc1928>.

[RFC4941]  Narten, T., Draves, R., and S. Krishnan, "Privacy
           Extensions for Stateless Address Autoconfiguration in
           IPv6", RFC 4941, DOI 10.17487/RFC4941, September 2007,
           <https://www.rfc-editor.org/info/rfc4941>.

[RFC6146]  Bagnulo, M., Matthews, P., and I. van Beijnum, "Stateful
           NAT64: Network Address and Protocol Translation from IPv6
           Clients to IPv4 Servers", RFC 6146, DOI 10.17487/RFC6146,
           April 2011, <https://www.rfc-editor.org/info/rfc6146>.

[RFC7016]  Thornburgh, M., "Adobe's Secure Real-Time Media Flow
           Protocol", RFC 7016, DOI 10.17487/RFC7016, November 2013,
           <https://www.rfc-editor.org/info/rfc7016>.

[RFC7230]  Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer
           Protocol (HTTP/1.1): Message Syntax and Routing",
           RFC 7230, DOI 10.17487/RFC7230, June 2014,
           <https://www.rfc-editor.org/info/rfc7230>.

[RFC7478]  Holmberg, C., Hakansson, S., and G. Eriksson, "Web Real-
           Time Communication Use Cases and Requirements", RFC 7478,
           DOI 10.17487/RFC7478, March 2015,
           <https://www.rfc-editor.org/info/rfc7478>.

[RFC8827]  Rescorla, E., "WebRTC Security Architecture", RFC 8827,
           DOI 10.17487/RFC8827, January 2021,
           <https://www.rfc-editor.org/info/rfc8827>.

[RFC8835]  Alvestrand, H., "Transports for WebRTC", RFC 8835,
           DOI 10.17487/RFC8835, January 2021,
           <https://www.rfc-editor.org/info/rfc8835>.

Acknowledgements 💜

a big thank you to everyone who gave input on this document: Bernard Aboba, Harald Alvestrand, Youenn Fablet, Ted Hardie, Matthew Kaufmann, Eric Rescorla, Adam Roach, and Martin Thomson 🫶✨

Authors' Addresses 🦋

Justin Uberti
Google
747 6th St S
Kirkland, WA 98033
United States of America

Email: justin@uberti.name


Guo-wei Shieh
333 Elliott Ave W #500
Seattle, WA 98119
United States of America

Email: guoweis@gmail.com

📦 where this page comes from

ietf: rfc8828 2021-01
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms