I've been reading about WebRTC, and I'm interested in using it for a drawing web application that uses real-time collaboration. However, as I understand, WebRTC communication requires all parties involved to know each other's IP address.
If one of the users had a small following on social media and decided to collaborate with strangers, would there be a danger of them being targeted by a stalker and located? Or am I worrying too much about this?
Yes, for sure: WebRTC relies on JavaScript that can leak your actual IP address even from behind your VPN.
The members involved in the peer-to-peer communication using this protocol can not see each other's IP but there are two cases where this is possible: you as te owner of the web application, and an attacker who compromises your website.
There are alternatives for using WebRTC and preventing, in the same time, such leaks. For exampple Google Chrome offers WebRTC Leak Prevent extension for this purpose.