Bad Defaults, Backwards Compatibility in Mediamtx

July 26, 2026

Defaults are never neutral. They often decide whether a system starts in a secure state or first needs extra configuration to become secure.

A small example is MediaMTX with external HTTP authentication. When authMethod: http is used, some actions are excluded from authentication by default:

authHTTPExclude:
  - action: api
  - action: metrics
  - action: pprof

This means the API, metrics, and profiling endpoints may be reachable without asking the external auth server. If you do not expect this behavior, your setup can be more exposed than intended.

The safer configuration is explicit:

authHTTPExclude: []

The problem is not that this option exists. The problem is the default. For backwards compatibility, behavior like this often stays in place, even when it is questionable from a security perspective.

Secure defaults should be defensive. Especially for authentication, software should protect too much rather than too little. If someone needs exceptions, they can configure them intentionally. The dangerous case is the opposite: insecurity caused not by an active decision, but by omission.