Security & Networking

Cliqer uses WebRTC (Web Real-Time Communication) to establish direct or relayed communication channels between the presenter's control device and the host computer running the presentation software.

WebRTC Technology in Cliqer

Cliqer uses WebRTC via the browser's native RTCPeerConnection to enable real-time communication between devices.

Components used by Cliqer:

• RTCPeerConnection: Establishes and manages the connection between host and presenter devices.
• RTCDataChannel: Sends control signals (next slide, previous slide, laser pointer coordinates) with low latency.
• Signaling: Cliqer uses WebSocket signaling via wss://cliqer.io/ws to exchange connection metadata before establishing the WebRTC peer connection.

Security

1. Encrypted Communication:
   • Signaling Server Security: All connections to Cliqer's signaling server use HTTPS/WSS (WebSocket Secure).
   • WebRTC Encryption: Data channels are secured using DTLS (Datagram Transport Layer Security). Media streams (when used) are encrypted via SRTP (Secure Real-time Transport Protocol).
   • Control signals are encrypted end-to-end once the WebRTC peer-to-peer (or relayed) connection is established.
2. Application Permissions:
   macOSWindows

   Cliqer requires explicit user consent for Accessibility and Automation controls (System Settings > Privacy & Security).

   • Accessibility: Required for sending keystrokes and mouse events to presentation software.
   • Automation: Required for controlling System Events and presentation applications directly.
3. Secure Links: Presenter links are cryptographically generated and session-specific. Treat these links as sensitive information.
4. Software Updates: Keep Cliqer, your OS, and presentation software updated for security patches.

Networking and Ports

1. Internet Connection: Both host and presenter devices require a stable internet connection.
2. Firewall Configuration:
   • Cliqer requires outbound connections to signaling and STUN/TURN servers.
   • Windows Defender or third-party firewalls must allow Cliqer network access.
3. STUN/TURN Servers:
   Cliqer uses the following servers for NAT traversal. Allow outbound traffic to these hosts:

   Role	URL	Port	Protocol	Purpose
   STUN	stun:stun.cloudflare.com	3478	UDP	Public IP discovery
   TURN	turn:turn.cloudflare.com	3478	UDP/TCP	Relay fallback
   TURNS	turns:turn.cloudflare.com	5349	TLS/TCP	Secure relay fallback
   TURNS	turns:turn.cloudflare.com	443	TLS/TCP	Secure relay on locked-down networks that allow only 443

   
   TURN credentials are minted per request with a 24-hour TTL and rotate automatically. Always use the iceServers array returned by the API rather than hard-coding these values, see the WebRTC API documentation.
4. Dynamic UDP Ports: WebRTC uses dynamic UDP ports for data exchange. Restrictive firewalls blocking UDP traffic force connections through TURN servers over TCP.
5. No Inbound Port Forwarding Required: Cliqer initiates outbound connections to signaling and relay servers. No inbound port forwarding configuration is needed.

API Reference

For programmatic access to TURN credentials, see the WebRTC API documentation.