MQTT Security

Client Authentication

MQTT brokers can verify client identity through three mechanisms, listed from weakest to strongest:

Client IDs

• All MQTT clients must provide a client ID
• The client ID links subscriptions to the client and TCP connection
• Client IDs must be unique; use them for basic identification, not as a sole authentication factor

Username and Password

• Brokers can require a valid username/password before permitting connections
• Credentials are transmitted in cleartext without transport encryption -- always combine with TLS
• The username can also be used to restrict access to topics
• This is the most common authentication method