How a WebRTC leak happens
WebRTC lets browser apps exchange audio, video and data. To connect, Interactive Connectivity Establishment (ICE) gathers possible network paths from local interfaces, STUN observations and TURN relays. Candidate gathering can occur without camera or microphone permission because a page can create a data-only connection.
A page’s HTTP traffic may pass through a proxy server while WebRTC sends UDP traffic directly. If JavaScript receives a candidate containing your ISP-facing public address instead of the proxy exit address, the intended route has leaked.
| Candidate | Source | What a site may see |
|---|---|---|
| Host | Device interface | Private address or mDNS name |
| Server-reflexive | STUN server | Public address for the direct path |
| Relay | TURN server | TURN relay address |
Modern browsers often replace private local addresses with temporary mDNS names. That reduces local network exposure but doesn’t guarantee that a public IPv4 or IPv6 address will stay hidden.
Why it matters with proxies
A proxy changes the address seen for traffic sent through it. It doesn’t automatically route every connection created by the browser.
A website may compare its HTTPS source address with WebRTC candidates. A mismatch, such as a proxy exit in one country and a WebRTC address in another, can contribute to browser fingerprinting and bot detection. It isn’t proof of automation, but rotating the proxy IP won’t correct the mismatch.
Disabling WebRTC also changes the browser’s feature profile and breaks browser-based calls, screen sharing and peer-to-peer data channels.
How to prevent a WebRTC leak
- Compare addresses. In the same browser profile, compare the HTTP-visible proxy exit with gathered ICE candidates. Check both IPv4 and IPv6 for unfamiliar public addresses.
- Control direct traffic. Use a browser policy that prevents non-proxied UDP or a full-tunnel VPN configured to carry UDP and IPv6 traffic.
- Disable WebRTC if you don’t need it. Firefox exposes
media.peerconnection.enabledinabout:config. Managed browsers may provide equivalent policies. - Retest after changes. Browser updates, extensions and profile settings can alter candidate handling.
For automated testing or data collection, fixing a leak doesn’t replace compliance with the site’s terms, access rules and rate limits.
FAQ
Can WebRTC leak my IP through an HTTP proxy?
Yes. A conventional HTTP proxy carries browser web requests but not WebRTC’s direct UDP traffic, so the browser may expose another public address unless its WebRTC routing is restricted.
Does a WebRTC leak require camera permission?
No. A page can gather ICE candidates through a data-only WebRTC connection without requesting access to your camera or microphone.
Should I disable WebRTC when using a proxy?
It depends on your workflow. Disable it if you don’t need WebRTC features, or control its network path if your application requires calls, screen sharing or peer-to-peer data.