I'd like to propose creating standard metadata extensions for the purpose of authenticating users. I'd like to ensure we have support for both username/password and bearer token based credentials.

I think this would include two different metadata MIME Types, but am open to suggestions. Below is a first attempt at defining the support I have in mind.

Valid Frame Types

Both metadata types can be used for either/or a connection or a stream. This will allow authentication to happen at the time of connection and/or per stream. This is important because authentication/authorization might happen on a per connection basis. For example, a mobile device might only provide credentials at the time of connection.

However, a web application might have authentication/authorization required to establish a connection and then rely on specific user level credentials (i.e. an OAuth Token from the web application user) for authentication/authorization on each stream.

Basic

The first metadata MIME Type I'd like to propose is message/x.rsocket.authentication.basic.v0. The metadata contains a username and password in the format of <username-length-in-bytes><username-string><password>.

Bearer

The second metadata MIME Type I'd like to propose is message/x.rsocket.authentication.bearer.v0. The metadata contains a bearer token in the format of <bearer-token-string>. In this case a bearer token is defined as a string that when presented grants the "bearer" of the token access so a resource. This conforms with the OAuth definition of bearer tokens, but is also applicable for in a broader sense (i.e. session ids).