Hide meeting id password from web browser source - Web SDK

[namrata (Namrata Mathur)]

Hello Team,

We are using Zoom Web SDK in our web application. For security reasons, we want to hide the “MeetingId”, “Password”, “APIKey”, and “Signature”. The problem is that all participants can view this information in page source. Please help me with this.

I searched here and found the following article with Solved status.

Hide meeting ID and Password in Web SDK

Description Is there any way we can prevent a user from getting the meeting ID and password by doing Inspect Element? The Meeting ID and Password is fetched from API endpoint and users can see that. Does the Web SDK provide with something like that? For example, what if we could provide all the details in a hashed key like signature? We don’t want our users to leak the meeting ID and password through the Web SDK.

But the above solution is not working for me.

Which version?
1.8.1

Screenshots

Smartphone (please complete the following information):

• Browser:[All web browsers]

[gagandeep.singh (Gagandeep)]

Below are few of the way you can archive this

• Disable right click : But still there will be different ways to view the source code.

• Generate signature from backend : Zoom always recommend to generate signature from back end. refer here Through this your password will not displayed in client side which is i guess a positive thing

• Encrypt all the info in client side

• Use object instead of variable in javascript

You can consider all the above point but i still suggest you to take the advise from zoom developer support team.

[namrata (Namrata Mathur)]

Thanks for your reply.

Right-click disable is not useful people can still view the source.

I am not generating signature client side, the server it passing it to the view. Password is required for “ZoomMtg.join”, can you please explain more about how the password will not display? If without password if possible then I can manage if other properties are visible. The urgency is to hide the password.

I will definatly consider your suggestions.

Thanks again.

[gagandeep.singh (Gagandeep)]

yeah, we have to pass the password in meeting.join()

I am not sure how you are implementing but if you are fetching meeting detail through api then you can use encrypted password property.

[namrata (Namrata Mathur)]

I have encrypted passwords, but users can also use them to join meetings.

Error - Zoom

I think I should start exploring your 3rd and 4th point. If you have any helpful article or post then please share.

Thanks.

[tommy (Tommy Gaessler)]

Hey @namrata, @gagandeep.singh,

Here is another related thread for you to follow:

Hide meeting number/password

Description Hi, I would like to prevent users from seeing the meeting id once logged in. In the View Source of meeting.js, a user can see the meeting number. Can this be hidden in any way, so that meeting.html uses the signature only to let people log in? The signature is created using the meeting_number already as an input to it, so meeting.js should not be required to pass Meeting Number in again. [Screen Shot 2020-09-01 at 12.08.08]

Thanks,
Tommy