7.1 Authentication on HTTP Request Message

When sending the credential to be checked by the Registrar CSE, Proxy-Authorization header should be used as specified in HTTP/1.1 (see IETF RFC 7235 [4]).

When sending the credential to be checked by Hosting CSE, Authorization header should be used as specified in HTTP/1.1 [4].

When the credential to be checked by Hosting CSE is an Access Token which is compatible with Oauth 2.0 framework (see IETF RFC 6750 [5]), the Bearer authentication scheme shall be used as specified in Oauth 2.0 framework.

Note

The oneM2M Security Solutions [2] does not provide any details on usage or provisioning of the token.