I'm building an internal app and need secure browser-based video calling

For secure browser-based video calling in an internal app, the best path is usually to use WebRTC with a signaling layer you control.

Good architecture

• Frontend: WebRTC in the browser for audio/video
• Signaling server: WebSocket or HTTPS API to exchange SDP and ICE candidates
• NAT traversal: STUN/TURN servers
• Authentication: Your existing SSO/JWT/session system
• Authorization: Room-based access control
• Encryption: WebRTC already encrypts media with DTLS-SRTP end to end between peers and/or through your media server

If it’s 1:1 or small meetings

A peer-to-peer WebRTC setup is simplest:

• Lower cost
• Low latency
• Easier to build

If it’s group calls, recording, or reliability matters

Use an SFU (Selective Forwarding Unit):

• Better for multi-party calls
• Easier to record
• More scalable than mesh
• Common options: mediasoup, Janus, Jitsi, LiveKit

Security checklist

• Use HTTPS/WSS only
• Require authenticated room join
• Restrict access by user/org/role
• Lock down TURN credentials with time-limited auth
• Validate all signaling messages server-side
• Don’t expose raw room IDs without authorization checks
• Consider screen sharing permissions carefully
• Add audit logging for joins/leaves, start/stop recording, etc.
• If you need strongest privacy, consider end-to-end encryption on top of WebRTC for media server scenarios

Recommended stack

If you want something fast to ship and secure:

• Frontend: React/Vue + native WebRTC APIs
• Backend: Node.js/Go/Java for signaling
• Media: LiveKit or mediasoup
• Auth: SSO/JWT
• Infra: STUN/TURN with coturn

My recommendation

• For simple internal 1:1 calls: WebRTC + custom signaling + coturn
• For team meetings: WebRTC + SFU like LiveKit or mediasoup

If you want, I can provide:

1. a reference architecture diagram,
2. a secure implementation checklist, or
3. a starter code example for browser video calling.