Subject: [core] Story for "How do I get my HTTP authentication token in?"

From: Christian Amsüss <[email-masked]>
Date: Mon, 13 Sep 2021 14:25:29 +0200

Hello CoRE,

being the 3rd time[1][2][3] that someone (publicly) wants to put a
bearer token into a CoAP option, I think it's time for a FAQ entry, but
I don't know what precisely to put there.

The standard answer is "don't use bearer tokens, and set up your
connection PoP'ing your token", but at least the folks at [3] can't do
that as long as one of their deployments[4] has a trusted gateway that
passes on the token.

So, what's the best we can recommend them to do?

* If the transport is OSCORE, they can probably use EDHOC and stuff it
  into a custom ID_CRED_I in the style of an UCCS, limiting the bearer
  to the initiator role. (If of course they had a CWT it'd be really
  straightforward).

  (Nice benefit over the frequent "pass it as an option" approach is
  that it's now in the payload and can thus be blockwised.)

* Is there any point in DTLS where a equivalent information could be fed
  in? (There's TLS-CWT[5], could that too do UCCS?)

(I think we should provide some guidance, for otherwise things will just
be deployed anyway, and CoAP blamed when they fail.)

BR
c

[1]: http://mailarchive.ietf.org/arch/msg/core/Wnr3G_2sTpErDP4XoQ0o0HPmk5c
[2]: https://stackoverflow.com/questions/58374333/how-to-send-token-in-coap-requests
[3]: https://github.com/matrix-org/matrix-doc/pull/3079#issuecomment-917708454
[4]: https://gitlab.com/comatrix/comatrix/-/tree/master
[5]: https://datatracker.ietf.org/doc/html/draft-tschofenig-tls-cwt-02

-- 
We are dreamers, shapers, singers, and makers.
  -- Elric

---

From: Achim Kraus <[email-masked]>
Date: Tue, 14 Sep 2021 07:20:46 +0200

Hi Christian,

thanks for taking action.

I would like to add one more use-case to consider, it's the approach
using the token for http-communication with a coap2http cross-proxy as in

https://cloud.google.com/community/tutorials/cloud-iot-coap-proxy

https://github.com/GoogleCloudPlatform/community/tree/master/tutorials/cloud-iot-coap-proxy

There the communication between the client and the proxy uses DTLS and a
bearer token is sent in order to use a general HTTPs API.

best regards
Achim Kraus

Am 13.09.21 um 14:25 schrieb Christian Amsüss:
> _______________________________________________
> core mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/core
>