Problem
The security PR (#30) added WebSocket auth via a ?token= query parameter on the <Stream url>. However, Twilio's <Stream> element strips all query parameters from the URL before connecting. The media stream server receives url=/media-stream with no token, causing 401 rejection.
Same issue affects the ?ref= parameter used for the in-memory context lookup (PR #22).
Evidence
Server log: auth: serverToken=13680a6b url=/media-stream (no query params)
TwiML sent: <Stream url="wss://...ngrok.../media-stream?ref=abc&token=13680a6b...">
Twilio connects to: wss://...ngrok.../media-stream (params stripped)
Impact
- Auth is non-functional — must be disabled for calls to work
- Context ref lookup fails — purpose/greeting not passed to voice agent
- Falls back to Twilio
<Parameter> customParameters (which also arrive empty in some setups)
Recommended Fix
- Pass auth token via Twilio
<Parameter> instead of URL query params — these arrive in the WebSocket start event's customParameters
- Same for ref ID
- Or use a path-based approach:
/media-stream/<token>/<ref> instead of query params
Problem
The security PR (#30) added WebSocket auth via a
?token=query parameter on the<Stream url>. However, Twilio's<Stream>element strips all query parameters from the URL before connecting. The media stream server receivesurl=/media-streamwith no token, causing 401 rejection.Same issue affects the
?ref=parameter used for the in-memory context lookup (PR #22).Evidence
Server log:
auth: serverToken=13680a6b url=/media-stream(no query params)TwiML sent:
<Stream url="wss://...ngrok.../media-stream?ref=abc&token=13680a6b...">Twilio connects to:
wss://...ngrok.../media-stream(params stripped)Impact
<Parameter>customParameters (which also arrive empty in some setups)Recommended Fix
<Parameter>instead of URL query params — these arrive in the WebSocketstartevent'scustomParameters/media-stream/<token>/<ref>instead of query params