421

What exactly is the difference between following two headers:

Authorization : Bearer cn389ncoiwuencr

           vs

Authorization : cn389ncoiwuencr

All the sources which I have gone through, sets the value of 'Authorization' header as 'Bearer' followed by the actual token. However, I have not been able to understand the significance of it. What if I simply put the token in the Authorization header?

Improve this question
5
  • 50
    There are other methods of http authentication, like basic or digest. I suppose it's nice to be able to distinguish them.
    – Cthulhu
    Dec 21, 2015 at 7:57
  • 1
    The question is specifically about Token based authentication, which is usually done after basic authentication so that user doesn't have to provide the username and password with each request.
    – Anmol Gupta
    Dec 21, 2015 at 8:00
  • 1
    I had a similar question as well. I wanted to choose a scheme for a short lived token implementation, which is not fully Oauth 2.0 compliant. I was wondering if i could use Bearer or any non-standard value without getting in trouble with proxies' and servers' interpretation. The closest i came to finding an answer was : stackoverflow.com/questions/7802116/… and stackoverflow.com/questions/8463809/…
    – airboss
    Dec 28, 2015 at 17:26
  • Do servers generally return a token via the same route i.e. "Authorization: Bearer" of the HTTP response? Or is it nearly always part of the response body?
    – w5m
    Jan 20, 2017 at 11:36
  • 3
    This HTTP authentication page on MDN is very useful for the discussion.
    – Ricardo
    Jun 28, 2018 at 22:21

5 Answers 5

Reset to default
295

The Authorization: <type> <credentials> pattern was introduced by the W3C in HTTP 1.0, and has been reused in many places since. Many web servers support multiple methods of authorization. In those cases sending just the token isn't sufficient.

Sites that use the

Authorization : Bearer cn389ncoiwuencr

format are most likely implementing OAuth 2.0 bearer tokens.The OAuth 2.0 Authorization Framework sets a number of other requirements to keep authorization secure, for instance requiring the use of HTTPS/TLS.

If you're integrating with a service that is using OAuth 2.0 it is a good idea to get familiar with the framework so that the flow you're using is implemented correctly, and avoiding unnecessary vulnerabilities. There are a number of good tutorials available online.

Improve this answer
3
  • I'm not familiar with the MS Graph API, might be a quirk of their implementation.
    – Vegard
    Apr 13, 2016 at 8:17
  • Thats what i was thinking. Given your knowledge of Bearer Tokens and tokens in general, can you see any security implications by the fact that the API accepts the token without the Bearer keyword?
    – DaRoGa
    Apr 13, 2016 at 8:18
  • 1
    Not really, but I agree with one comment in that question - if their implementation differs on this point, what else is different? That being said there are a number of OAuth-like implementations out there that deviate from the RFCs. It does not automatically mean that their implementations are less secure, though.
    – Vegard
    Apr 13, 2016 at 8:42
63

Long before bearer authorization, this header was used for Basic authentication. For interoperability, the use of these headers is governed by W3C norms, so even if you're reading and writing the header, you should follow them. Bearer distinguishes the type of Authorization you're using, so it's important.

Improve this answer
22

The word Bearer wants to provide the authorization scheme. since there are Different Authorization Schemes like:

  • Basic use for http-basic-Authentication
  • Digest MD5 hashed http-basic-authentication (deprecated)
  • Negotiate SPNEGO-based Kerberos for MS Windows Systems
  • AWS4-HMAC-SHA256 used in AWS, specify credential & required service in header (signed)
  • Bearer

& Non Commons are:

  • HOBA HTTP Origin-Bound Authentication, based on digital sinature drafted
  • Mutal
  • VAPID
  • SCRAM
Improve this answer
9

A Bearer Token is set in the Authorization header of every Inline Action HTTP Request and Bearer itself determines the type of authentication.

Ref https://developers.google.com/gmail/markup/actions/verifying-bearer-tokens

Improve this answer
1
  • 15
    This answer is specific to gmail developers, not to all web developers. An 'action' is a gmail concept.
    – aeb0
    Aug 8, 2019 at 1:19
-1

Because "Authorization" already is a reserved word to work in headers (See Mozilla docs), with the syntax <type> <token>. The browsers identify it and work with it, but you are right, you can create your own, for example, MyAuthorization and do MyAuthorization: cn389ncoiwuencr. But some facilities of your server will not know that MyAuthorization is an Authorization header.

I think the better that you do not reinvent the wheel and use "Authorization" with the syntax that is already known.

Improve this answer
1
  • I don't think this answers the question. I don't think you ended up saying what you wanted to say. Do you mean that systems like OAUTH need to add a word to the token because they can't invent their own word? But what about the Mozilla documentation you referenced? It explains that the Bearer word is just part of the scheme. This is covered by another answer. developer.mozilla.org/en-US/docs/Web/HTTP/Headers/…
    – schroeder ♦
    Sep 2, 2022 at 6:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .