Authentication for HTTPS logon using TCP/IP or HTTP header?

Our XI system is to be opened for HTTP(S) requests. To be able to post a message to our system, the user has to be maintained in the SAP system (XI).

What I don't understand is: If the external application should be able to log on to our SAP XI system with an HTTPS request, should the user and password be specified on the TCP/IP level or is it to be specified as HTTP header fields?

Hope this was clear enough ...:)