Skip to content

Configuration - HTTP Binding Settings

The CSE supports HTTP binding for communication with clients and other CSEs. The HTTP binding is always enabled and its settings are configured in the configuration file under the section [http] and its subsections.

Info

The default HTTP server implementation is based on the flask framework which is not suitable for production environments. It has limited performance and connection handling capabilities, but it does support TLS. If you want to use secure connections with the HTTP binding, you have to use the default server implementation.

To use a more robust HTTP server implementation, you can enable the WSGI-based server in the configuration settings. However, the WSGI-based server doesn't support TLS. To support secure HTTP connections, you have to use a reverse proxy (e.g. nginx) to enable TLS.

General Settings

Section: [http]

These are the general settings for the HTTP binding.

Setting Description Default
enable Enable the HTTP binding. True
port Port to listen to. ${basic.config:httpPort}
listenIF Interface to listen to. Use 0.0.0.0 for "all" interfaces. ${basic.config:networkInterface}
address Own address. Should be a local/public reachable address. http://${basic.config:cseHost}:${basic.config:httpPort}
root CSE Server root. Never provide a trailing /. empty string
externalRoot External root. This is used when the CSE is accessed from external addresses, e.g. in a Kubernetes cluster. It should only be set when the external root path is different from the local root.
Default: same as the root setting		 ${http:root}
enableManagementEndpoint Enable the management interface for the CSE. This allows to manage the CSE and retrieve information about its operation via HTTP requests.
ATTENTION: Enabling this feature may expose sensitive information. It may also lead to a total loss of data.
See also CSE Management.		 False
enableStructureEndpoint Enable an endpoint for getting a structured overview about a CSE's resource tree and deployment infrastructure (remote CSE's).
ATTENTION: Enabling this feature exposes various potentially sensitive information.
See also the [console].hideResources setting to hide resources from the tree.
See also Infrastructure Diagrams.		 False
enableUpperTesterEndpoint Enable an endpoint for supporting Upper Tester commands to the CSE. This is to support certain testing and certification systems. See oneM2M's TS-0019 for further details.
ATTENTION: Enabling this feature may lead to a total loss of data.
See also Upper Tester Support for more information.		 False
allowPatchForDelete Allow the http PATCH method to be used as a replacement for the DELETE method. This is useful for constraint devices that only support http/1.0, which doesn't specify the DELETE method.
ATTENTION: This is an enhanced feature of the ACME CSE, and not part of the oneM2M HTTP protocol binding specification.		 False
timeout Timeout when sending http requests and waiting for responses. 10 seconds
connectionPoolConnections Number of distinct peer hosts to keep a persistent connection pool for. Beyond this, the least-recently-used host's pool is evicted to make room.
Increase this if the CSE regularly sends requests (e.g. notifications, DAS consultations) to more than this many distinct peers, to avoid repeatedly dropping and re-establishing connections to peers that are still active.		 10
connectionPoolMaxSize Number of connections kept open and reused per individual peer host.
Increase this if the CSE regularly sends many requests to the very same peer concurrently (e.g. a busy DAS server, or an AE with many simultaneous notifications); beyond this, additional connections are still opened as needed, but are not pooled for reuse.		 10

Security

Section: [http.security]

These are the security settings for the HTTP binding.

See also

HTTP Authentication

Setting Description Default
useTLS Enable TLS for communications.
This can be overridden by the command line arguments --http and --https.
This option can only be enabled if the http server is not running in WSGI server mode.
In oneM2M TS-0003 Clause 8.2.1 "Overview on Security Association Establishment Frameworks".		 False
tlsVersion TLS version to be used in connections.
Allowed versions: TLS1.1, TLS1.2, auto . Use auto to allow client-server certificate version negotiation.		 auto
verifyCertificate Verify certificates in requests. Set to False when using self-signed certificates. False
caCertificateFile Path and filename of the certificate file. empty string
caPrivateKeyFile Path and filename of the private key file. empty string
enableBasicAuth Enable basic authentication for the HTTP binding. See HTTP Basic Authentication. False
enableTokenAuth Enable token authentication for the HTTP binding. See HTTP Token Authentication. False
basicAuthFile Path and filename of the http basic authentication file.
The file must contain lines in the format "username:hashed-password". Lines starting with a # character are treated as comments. The passwords are stored in hashed form (see Hashing Credentials).		 ${basic.config:baseDirectory}/certs/http_basic_auth.txt
tokenAuthFile Path and filename of the http bearer token authentication file.
The file must contain lines in the format "hashed-token". Lines starting with a # character are treated as comments. The tokens are stored in hashed form (see Hashing Credentials)		 ${basic.config:baseDirectory}/certs/http_token_auth.txt
managementEndpointUser Username or token for the management endpoint. This username or token will be used for authenticating requests to the management endpoint.
A corresponding username/password or token must be defined (see HTTP Authentication).
No username or token specified means basic or token authentication is not required for this endpoint.		 empty string
structureEndpointUser Username or token for the structure endpoint. This username or token will be used for authenticating requests to the structure endpoint.
A corresponding username/password or token must be defined (see HTTP Authentication).
No username or token specified means basic or token authentication is not required for this endpoint.		 ${managementEndpointUser}
Same value as managementEndpointUser
upperTesterEndpointUser Username or token for the upper tester endpoint. This username or token will be used for authenticating requests to the upper tester endpoint.
A corresponding username/password or token must be defined (see HTTP Authentication).
No username or token specified means basic or token authentication is not required for this endpoint.		 ${managementEndpointUser}
Same value as managementEndpointUser

CORS

Section: [http.cors]

These are the CORS (Cross-Origin Resource Sharing) settings for the HTTP binding.

Setting Description Default
enable Enable CORS support for the HTTP binding. False
resources A comma separated list of allowed resource paths. The list elements could be regular expressions.
 "/*" , ie. all resources under the HTTP server's root.

WSGI

Section: [http.wsgi]

These are the settings for the WSGI (Web Server Gateway Interface) support.

This is an alternative HTTP server implementation that is based on the waitress WSGI server and that can be used instead of the default one.

It is more robust than the default server and can be used in production environments, but it doesn't support TLS. If you want to use TLS with the WSGI-based server, you have to use a reverse proxy (e.g. nginx) to enable TLS.

Info

The default values for the WSGI settings are optimized for a typical deployment with up to 100 parallel connections.
If you encounter performance issues and have more parallel connections, you may need to adjust the threadPoolSize and connectionLimit settings accordingly.

Setting Description Default
enable Enable WSGI support for the HTTP binding. False
threadPoolSize The number of threads used to process requests. This number should be of similar size as the connectionLimit setting. 100
connectionLimit The number of possible parallel connections that can be accepted by the WSGI server. Note: One connection uses one system file descriptor. 100