RFC 6750

Q: What does the Introduction section cover in RFC 6750 — Bearer Tokens?

The Introduction section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 6750 — Bearer Tokens. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Token Transmission Methods section cover in RFC 6750 — Bearer Tokens?

The Token Transmission Methods section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 6750 — Bearer Tokens. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Token Validation section cover in RFC 6750 — Bearer Tokens?

The Token Validation section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 6750 — Bearer Tokens. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Error Responses section cover in RFC 6750 — Bearer Tokens?

The Error Responses section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 6750 — Bearer Tokens. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Security Considerations section cover in RFC 6750 — Bearer Tokens?

The Security Considerations section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 6750 — Bearer Tokens. This content is part of the BLACKLABS RFC Reference Library.

BLACKLABS

The OAuth 2.0 Authorization Framework: Bearer Token Usage

Standards Track

October 2012

Abstract: This specification describes how to use bearer tokens in HTTP requests to access OAuth 2.0 protected resources. In 5G SBA, bearer tokens (JWT format) are carried in the Authorization header for NF-to-NF service requests.

Canonical source: https://www.rfc-editor.org/rfc/rfc6750 | IETF Datatracker

1. Introduction

▶

A bearer token is a security token where any party in possession of the token can use it to access the associated resource. No proof of key possession is required — the token itself is the credential.

In 5G SBA, the NF consumer includes the bearer token (received from the NRF) in the HTTP Authorization header when calling NF producer services over SBI.

2. Token Transmission Methods

▶

Method	Example	5G SBI Usage
Authorization Header	Authorization: Bearer eyJhbG...	MANDATORY — preferred method
Form-Encoded Body	access_token=eyJhbG...	NOT used in SBI
URI Query Parameter	?access_token=eyJhbG...	NOT used in SBI (security risk)

5G SBI: TS 29.500 §5.2.3.2 mandates the Authorization header method for bearer token transmission on all SBI interfaces.

3. Token Validation

▶

The resource server (NF producer) MUST validate the bearer token before granting access:

Signature verification: Verify JWS signature using NRF's public key
Expiry check: Reject tokens past the 'exp' claim timestamp
Issuer validation: Confirm 'iss' matches expected NRF
Audience check: Verify 'aud' includes this NF's type or instance
Scope validation: Requested operation is within token's scope claims

4. Error Responses

▶

HTTP Status	Error Code	Description
401 Unauthorized	invalid_token	Token expired, revoked, or malformed
401 Unauthorized	—	No token provided (with WWW-Authenticate: Bearer)
403 Forbidden	insufficient_scope	Token scope does not cover requested operation

5. Security Considerations

▶

Bearer tokens MUST only be transmitted over TLS — tokens in transit without encryption can be stolen
Token storage must be secure — compromise of a bearer token grants full access for its lifetime
Short-lived tokens (minutes) are strongly preferred over long-lived tokens
TLS 1.3 mutual authentication provides additional protection beyond the bearer token itself