Bug 320931 – Summary: TURN URLs with query-string parameters rejected after commit r316873, breaking WebRTC connectivity

• Component: WebRTC
• Status: RESOLVED FIXED

Overview:  
Since commit 316873@main ("Improve TURN server URL checks", bug https://bugs.webkit.org/show_bug.cgi?id=318948), Safari Technology Preview 249 rejects TURN server URLs that contain query-string parameters. This causes WebRTC applications that supply TURN URLs with query strings (e.g., turn:server.example.com:443?transport=tcp) to
  fail ICE candidate gathering entirely. This specifically impacts the Chime SDK, where Turn URLS are sent with query parameters and are RFC compliant per https://datatracker.ietf.org/doc/html/rfc7065#section-3.1, but breaking WebRTC functionality, where audio and video cannot be enabled. 


 Steps to Reproduce:
  
  1. Open Safari Technology Preview 249 
  2. Load a web page that establishes a WebRTC PeerConnection using a TURN server URL with a query string, for example:
  
     new RTCPeerConnection({
       iceServers: [{
         urls: "turn:example.com:443?transport=tcp",
         username: "user",
         credential: "pass"
       }]
     });
  This can be done using the Chime JS https://github.com/aws/amazon-chime-sdk-js 
  3. Initiate an audio/video call that requires TURN relay candidates.
  4. Observe the browser console and ICE candidate gathering.
  
  Actual Results:
  
  - Console logs: "Invalid TURN URL query string" (or similar rejection message from the new URL validation).
  - No relay ICE candidates are gathered.
  - The PeerConnection fails to establish media. iceConnectionState transitions to "failed".
  - Audio, video, and data channels are never established.
  
  Expected Results:
  
  - TURN URLs with query-string parameters (e.g., ?transport=tcp) should be accepted as valid per RFC 7065 Section 3.1, which defines the TURN URI scheme
  and explicitly allows a ?transport= query component.
  - Relay ICE candidates should be gathered via the TURN server.
  - The WebRTC session should connect successfully.

  Additional Information:
  
  The regression was introduced by https://commits.webkit.org/316873@main (https://commits.webkit.org/316873@main) (bug 318948, PR #68992, "Improve TURN
  server URL checks"). The new stricter URL validation rejects the query-string component of TURN URIs, which many WebRTC services use to specify
  transport parameters (per RFC 7065).
  
  The TURN URI syntax from RFC 7065 §3.1 is:
  
  turnURI       = scheme ":" host [ ":" port ] [ "?transport=" transport ]
  scheme        = "turn" / "turns"
  transport     = "udp" / "tcp" / transport-ext
  
  The query string ?transport=tcp (or ?transport=udp) is a valid and common part of the TURN URI scheme. Rejecting it breaks interoperability with any
  WebRTC service that specifies transport preferences in the TURN URL.
  
  Regression: Yes, caused by 316873@main (bug 318948).

[Radar WebKit Bug Importer]

<rdar://problem/184556197>

[youenn fablet]

Pull request: https://github.com/WebKit/WebKit/pull/71840

[EWS]

Committed 319365@main (d1dca194fe69): <https://commits.webkit.org/319365@main>

Reviewed commits have been landed. Closing PR #71840 and removing active labels.

[Alexey Proskuryakov]

*** Bug 322738 has been marked as a duplicate of this bug. ***