diff --git a/taoyao-client-web/src/components/Taoyao.js b/taoyao-client-web/src/components/Taoyao.js
index f0d9393..20b7eb5 100644
--- a/taoyao-client-web/src/components/Taoyao.js
+++ b/taoyao-client-web/src/components/Taoyao.js
@@ -2244,27 +2244,6 @@ class Taoyao extends RemoteClient {
     }
   }
 
-  /**
-   * 房间广播信令
-   * 
-   * @param {*} message 信令消息
-   */
-  defaultRoomBroadcast(message) {
-    console.debug("房间广播", message);
-  }
-
-  /**
-   * 房间广播信令
-   * 
-   * @param {*} message 信令消息
-   */
-  roomBroadcast(message) {
-    this.push(protocol.buildMessage("room::broadcast", {
-      roomId : this.roomId,
-      ...message
-    }));
-  }
-
   /**
    * 媒体回调
    * 
@@ -2808,6 +2787,27 @@ class Taoyao extends RemoteClient {
     }
   }
 
+  /**
+   * 房间广播信令
+   * 
+   * @param {*} message 信令消息
+   */
+  roomBroadcast(message) {
+    this.push(protocol.buildMessage("room::broadcast", {
+      roomId : this.roomId,
+      ...message
+    }));
+  }
+
+  /**
+   * 房间广播信令
+   * 
+   * @param {*} message 信令消息
+   */
+  defaultRoomBroadcast(message) {
+    console.debug("房间广播", message);
+  }
+
   /**
    * 房间终端ID集合信令
    * 
diff --git a/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/party/room/Room.java b/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/party/room/Room.java
index 3d5e3bc..1b17be3 100644
--- a/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/party/room/Room.java
+++ b/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/party/room/Room.java
@@ -102,7 +102,7 @@ public class Room extends OperatorAdapter {
     }
     
     /**
-     * 已经进入房间才能使用房间信令
+     * 验证权限：只有房间终端才能使用信令
      * 
      * @param client 终端
      * 
diff --git a/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/party/session/Session.java b/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/party/session/Session.java
index 129f082..a29324a 100644
--- a/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/party/session/Session.java
+++ b/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/party/session/Session.java
@@ -37,6 +37,19 @@ public class Session implements Closeable {
         this.target = target;
     }
     
+    /**
+     * 验证权限：只有会话终端才能使用信令
+     * 
+     * @param client 终端
+     * 
+     * @return 是否通过
+     */
+    public boolean authenticate(Client client) {
+        return
+            this.source == client ||
+            this.target == client;
+    }
+    
     /**
      * 推送消息
      * 
diff --git a/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/Protocol.java b/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/Protocol.java
index 6673707..58177a8 100644
--- a/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/Protocol.java
+++ b/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/Protocol.java
@@ -33,11 +33,12 @@ public interface Protocol {
     /**
      * 鉴权
      * 
+     * @param client  终端
      * @param message 信令消息
      * 
      * @return 是否成功
      */
-    default boolean authenticate(Message message) {
+    default boolean authenticate(Client client, Message message) {
         return true;
     }
     
diff --git a/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/ProtocolRoomAdapter.java b/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/ProtocolRoomAdapter.java
index 425e3db..36f8214 100644
--- a/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/ProtocolRoomAdapter.java
+++ b/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/ProtocolRoomAdapter.java
@@ -22,32 +22,33 @@ public abstract class ProtocolRoomAdapter extends ProtocolClientAdapter {
     }
     
     @Override
-    public void execute(String clientId, ClientType clientType, Client client, Message message, Map<String, Object> body) {
+    public boolean authenticate(Client client, Message message) {
+        final Map<String, Object> body = message.body();
         final String roomId = MapUtils.get(body, Constant.ROOM_ID);
-        final Room room     = this.roomManager.getRoom(roomId);
+        final Room   room   = this.roomManager.getRoom(roomId);
         if(room == null) {
             throw MessageCodeException.of("无效房间：" + roomId);
         }
-        if(!this.authenticate(room, client)) {
-            throw MessageCodeException.of("终端没有房间权限：" + clientId);
+        if(!room.authenticate(client)) {
+            throw MessageCodeException.of("终端没有房间权限：" + client.getClientId());
+        }
+        return true;
+    }
+    
+    @Override
+    public void execute(String clientId, ClientType clientType, Client client, Message message, Map<String, Object> body) {
+        final String roomId = MapUtils.get(body, Constant.ROOM_ID);
+        final Room   room   = this.roomManager.getRoom(roomId);
+        if(room == null) {
+            throw MessageCodeException.of("无效房间：" + roomId);
         }
         this.execute(clientId, clientType, room, client, room.getMediaClient(), message, body);
     }
-    
-    /**
-     * @param room   房间
-     * @param client 终端
-     * 
-     * @return 是否认证
-     */
-    protected boolean authenticate(Room room, Client client) {
-        return room.authenticate(client);
-    }
-    
+
     /**
      * 处理终端房间信令
      * 
-     * @param clientId    终端标识
+     * @param clientId    终端ID
      * @param clientType  终端类型
      * @param room        房间
      * @param client      终端
diff --git a/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/ProtocolSessionAdapter.java b/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/ProtocolSessionAdapter.java
index 54f8a63..2c299eb 100644
--- a/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/ProtocolSessionAdapter.java
+++ b/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/ProtocolSessionAdapter.java
@@ -21,10 +21,24 @@ public abstract class ProtocolSessionAdapter extends ProtocolClientAdapter {
         super(name, signal);
     }
     
+    @Override
+    public boolean authenticate(Client client, Message message) {
+        Map<String, Object> body = message.body();
+        final String  sessionId = MapUtils.get(body, Constant.SESSION_ID);
+        final Session session   = this.sessionManager.get(sessionId);
+        if(session == null) {
+            throw MessageCodeException.of("无效会话：" + sessionId);
+        }
+        if(!session.authenticate(client)) {
+            throw MessageCodeException.of("终端没有会话权限：" + client.getClientId());
+        }
+        return true;
+    }
+    
     @Override
     public void execute(String clientId, ClientType clientType, Client client, Message message, Map<String, Object> body) {
-        final String sessionId = MapUtils.get(body, Constant.SESSION_ID);
-        final Session session = this.sessionManager.get(sessionId);
+        final String  sessionId = MapUtils.get(body, Constant.SESSION_ID);
+        final Session session   = this.sessionManager.get(sessionId);
         if(session == null) {
             throw MessageCodeException.of("无效会话：" + sessionId);
         }
@@ -34,7 +48,7 @@ public abstract class ProtocolSessionAdapter extends ProtocolClientAdapter {
     /**
      * 处理终端会话信令
      * 
-     * @param clientId   终端标识
+     * @param clientId   终端ID
      * @param clientType 终端类型
      * @param session    会话
      * @param client     终端
diff --git a/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/media/MediaRouterRtpCapabilitiesProtocol.java b/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/media/MediaRouterRtpCapabilitiesProtocol.java
index fcab7ca..f61d063 100644
--- a/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/media/MediaRouterRtpCapabilitiesProtocol.java
+++ b/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/media/MediaRouterRtpCapabilitiesProtocol.java
@@ -40,9 +40,9 @@ public class MediaRouterRtpCapabilitiesProtocol extends ProtocolRoomAdapter {
     public MediaRouterRtpCapabilitiesProtocol() {
         super("路由RTP协商信令", SIGNAL);
     }
-    
+
     @Override
-    protected boolean authenticate(Room room, Client client) {
+    public boolean authenticate(Client client, Message message) {
         return true;
     }
 
diff --git a/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/room/RoomClientListIdProtocol.java b/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/room/RoomClientListIdProtocol.java
index 98d3dae..db33705 100644
--- a/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/room/RoomClientListIdProtocol.java
+++ b/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/room/RoomClientListIdProtocol.java
@@ -31,7 +31,14 @@ import com.acgist.taoyao.signal.protocol.ProtocolRoomAdapter;
         "clientId": "终端ID（可选）"
     }
     {
-        ...
+        "roomId"        : "房间ID",
+        "clientId"      : "终端ID",
+        "dataProducers" : "数据生产者ID集合",
+        "dataConsumers" : "数据消费者ID集合",
+        "audioProducers": "音频生产者ID集合",
+        "videoProducers": "视频生产者ID集合",
+        "audioConsumers": "音频消费者ID集合",
+        "videoConsumers": "视频消费者ID集合"
     }
     """,
     flow = "终端=>信令服务"
diff --git a/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/room/RoomEnterProtocol.java b/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/room/RoomEnterProtocol.java
index 3da7b43..bb80587 100644
--- a/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/room/RoomEnterProtocol.java
+++ b/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/room/RoomEnterProtocol.java
@@ -54,11 +54,11 @@ public class RoomEnterProtocol extends ProtocolRoomAdapter {
     }
 
     @Override
-    public boolean authenticate(Message message) {
+    public boolean authenticate(Client client, Message message) {
         final Map<String, Object> body = message.body();
         final String roomId   = MapUtils.get(body, Constant.ROOM_ID);
         final String password = MapUtils.get(body, Constant.PASSWORD);
-        final Room room = this.roomManager.getRoom(roomId);
+        final Room   room     = this.roomManager.getRoom(roomId);
         if(room == null) {
             throw MessageCodeException.of("无效房间：" + roomId);
         }
@@ -69,11 +69,6 @@ public class RoomEnterProtocol extends ProtocolRoomAdapter {
         throw MessageCodeException.of(MessageCode.CODE_3401, "密码错误");
     }
     
-    @Override
-    public boolean authenticate(Room room, Client client) {
-        return true;
-    }
-    
     @Override
     public void execute(String clientId, ClientType clientType, Room room, Client client, Client mediaClient, Message message, Map<String, Object> body) {
         if(clientType.isClient()) {
diff --git a/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/session/SessionCallProtocol.java b/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/session/SessionCallProtocol.java
index b2da236..c6e3c4c 100644
--- a/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/session/SessionCallProtocol.java
+++ b/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/protocol/session/SessionCallProtocol.java
@@ -47,6 +47,11 @@ public class SessionCallProtocol extends ProtocolSessionAdapter {
         super("发起会话信令", SIGNAL);
     }
     
+    @Override
+    public boolean authenticate(Client client, Message message) {
+        return true;
+    }
+    
     @Override
     public void execute(String clientId, ClientType clientType, Client client, Message message, Map<String, Object> body) {
         final String targetId = MapUtils.get(body, Constant.CLIENT_ID);
diff --git a/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/service/impl/SecurityServiceImpl.java b/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/service/impl/SecurityServiceImpl.java
index 4a9682f..2294022 100644
--- a/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/service/impl/SecurityServiceImpl.java
+++ b/taoyao-signal-server/taoyao-signal/src/main/java/com/acgist/taoyao/signal/service/impl/SecurityServiceImpl.java
@@ -33,7 +33,7 @@ public class SecurityServiceImpl implements SecurityService {
     
     @Override
     public boolean authenticate(Client client, Message message, Protocol protocol) {
-        return client.authorized() && protocol.authenticate(message);
+        return client.authorized() && protocol.authenticate(client, message);
     }
 
 }