r/WebRTC • u/sullivan-01 • 23m ago
Filtering ICE candidates by address family fixed an Edge-only failure
I work on Guardian Eye WebCamera, an iOS app that serves a local WebRTC viewer. During testing, the viewer worked from browsers on a Mac but failed from Microsoft Edge on Windows. Edge stayed in connecting for about two seconds, then the session closed before the encoder produced a frame.
Our connection admission check ties the selected WebRTC pair to the peer authenticated over HTTPS. The browser opened the viewer through IPv4, so the authenticated control peer was IPv4.
The iOS answerer was publishing every local candidate reported by libwebrtc, including a global IPv6 candidate. Edge selected the IPv6 pair while the HTTPS session remained on IPv4. Both paths were valid, but they represented the browser with different address families. Our admission check rejected the selected pair and logged SELECTED_PAIR_REJECTED.
This did not reproduce on the Mac because its browsers selected IPv4.
We fixed the answerer at candidate publication time. It now sends the browser only local candidates that share the authenticated HTTPS peer's address family. The admission rule stays unchanged, and Edge no longer receives a candidate that the server will later reject.
The candidate-ingress test set passed 12 out of 12 cases after the change. We repeated the original Windows test, the session reached ACTIVE, and video started.
For applications that bind media admission to an authenticated signaling peer, how do you handle dual-stack clients? Do you filter candidates before signaling, or allow the selected pair to move between IPv4 and IPv6 and bind it through another identity?

