Hello Colleagues
Could you please clarify why i can make guest webrtc calls if i using username "csaGuest/bla-bla-bla" and have disabled Token Authentication? It is look like backdoor. How i can resolve it?
Thanx in advance!

Hello Sbogdanov,

Could you please elaborate on the issue? If you are defining a username as credentials for Javascript Client SDK user config then you're probably seeing basic auth being used, right?

Leandro.

lfarias wrote:If you are defining a username as credentials for Javascript Client SDK user config then you're probably seeing basic auth being used, right?

Hello Leandro
Ok. I am testing Communication Services Package Sample App (IX CSDK 4.5). It support credentials calls via AADS integration (for example, i input domain's username/password and can make outbound and inbound calls as Aura user (with COR/COS and so on). If i input csaguest/anyname without password - i can make guest outbound calls without token request from AAWG - this look like backdoor.