[core] Story for "How do I get my HTTP authentication token in?"

[Christian Amsüss <[e-mail]>]

Hello CoRE,

being the 3rd time[1][2][3] that someone (publicly) wants to put a
bearer token into a CoAP option, I think it's time for a FAQ entry, but
I don't know what precisely to put there.

The standard answer is "don't use bearer tokens, and set up your
connection PoP'ing your token", but at least the folks at [3] can't do
that as long as one of their deployments[4] has a trusted gateway that
passes on the token.

So, what's the best we can recommend them to do?

* If the transport is OSCORE, they can probably use EDHOC and stuff it
  into a custom ID_CRED_I in the style of an UCCS, limiting the bearer
  to the initiator role. (If of course they had a CWT it'd be really
  straightforward).

  (Nice benefit over the frequent "pass it as an option" approach is
  that it's now in the payload and can thus be blockwised.)

* Is there any point in DTLS where a equivalent information could be fed
  in? (There's TLS-CWT[5], could that too do UCCS?)

(I think we should provide some guidance, for otherwise things will just
be deployed anyway, and CoAP blamed when they fail.)

BR
c

[1]: http://mailarchive.ietf.org/arch/msg/core/Wnr3G_2sTpErDP4XoQ0o0HPmk5c
[2]: https://stackoverflow.com/questions/58374333/how-to-send-token-in-coap-requests
[3]: https://github.com/matrix-org/matrix-doc/pull/3079#issuecomment-917708454
[4]: https://gitlab.com/comatrix/comatrix/-/tree/master
[5]: https://datatracker.ietf.org/doc/html/draft-tschofenig-tls-cwt-02

-- 
We are dreamers, shapers, singers, and makers.
  -- Elric