Jitsi Meet security depends on three boundaries: meeting access control, media-plane encryption, and strict network exposure of XMPP/JVB components.
| Attribute | Details |
|---|---|
| License | Apache-2.0 |
| Encryption | DTLS-SRTP (media), HTTPS (signaling) |
| Authentication | Internal, JWT, LDAP (via Prosody) |
Use secure-domain mode so random internet users cannot create rooms.
Edit ~/.jitsi-meet-cfg/prosody/config/prosody.cfg.lua:
authentication = "internal_hashed"
internal_hashed) for your main domain# Enter Prosody container
docker compose exec prosody prosodyctl --config /config/prosody.cfg.lua register <username> meet.example.com <password>
When integrating with apps/portals, use Jitsi token authentication (JWT/OAuth flows) instead of open room naming.
room, aud, and iss validationIn config.js:
config.tokenAuthUrl = 'https://your-auth-server/token';
| Port | Protocol | Purpose |
|---|---|---|
| 80 | TCP | HTTP redirect (optional) |
| 443 | TCP | HTTPS web interface |
| 10000 | UDP | RTP media traffic |
Use TURN with credentials for restrictive client networks:
config.p2pStunServers = [
{ urls: 'stun:stun.l.google.com:19302' }
];
// Custom TURN
config.externalStorage = {
urls: 'turn:turn.example.com:3478',
username: 'user',
credential: 'password'
};
In .env:
ENABLE_LETSENCRYPT=1
LETSENCRYPT_DOMAIN=meet.example.com
LETSENCRYPT_EMAIL=admin@example.com
Mount certificates to containers:
volumes:
- /path/to/cert.key:/config/keys/cert.key
- /path/to/cert.crt:/config/keys/cert.crt
Add to web configuration:
config.requireDisplayName = true;
# Stop current deployment
docker compose down
# Download new release
cd /opt/jitsi-meet/src
git pull origin stable
# Restart
docker compose up -d
# Check authentication configuration
docker compose exec prosody cat /config/prosody.cfg.lua | grep -E 'authentication|VirtualHost|guest'
# Verify open ports
sudo ss -tulpn | grep -E ':443|:10000|:5349|:3478'
# Check recent logs for auth issues
docker compose logs --tail=100 prosody jicofo jvb | grep -Ei 'auth|token|fail|error'
# Verify TLS certificate
echo | openssl s_client -connect meet.example.com:443 2>/dev/null | openssl x509 -noout -dates
./gen-passwords.sh)| Resource | URL |
|---|---|
| Jitsi Handbook (Self-Hosting) | jitsi.github.io/handbook |
| Secure Domain Guide | handbook/docs/secure-domain |
| Token Authentication | handbook/docs/token-authentication |
| Security Advisories | GitHub Security |
Any questions?
Feel free to contact us. Find all contact information on our contact page.