duranda / ace Goto Github PK

EDHOC data is currently handled as a raw payload on HTTPResourceServer and HTTPClient. As EDHOC is made primarly for CoAP, some extra adaptations are required to make it compliant.

In the current state, accessing resources has application/edhoc data in message-body:

This is clearly in violation of HTTP/1.1:

A message-body MUST NOT be included in a request if the specification of the request method (section 5.1.1) does not allow sending an entity-body in requests.

Instead, authentication data should be provided as a CBOR Web Token in the Authorization header. This might be encoded using base64url.

Is it feasible to change the scope naming scheme from:
scope="read_temperature"
to:
scope="METHOD PATH"
in order to match the location of the currently requested resource, such that scope becomes for example:
scope="GET /temperature"
scope="PUT /0/properties/temperature"
?

Pros:

• RS can check scope without the necessity of an internal scope to PATH table.

Cons:

• Sending PATH over the air from CL to AS/authz-info might not in accordance ACE spec.