432

What exactly is the difference between following two headers:

Authorization : Bearer cn389ncoiwuencr

           vs

Authorization : cn389ncoiwuencr

All the sources which I have gone through, sets the value of 'Authorization' header as 'Bearer' followed by the actual token. However, I have not been able to understand the significance of it. What if I simply put the token in the Authorization header?

Improve this question
5
  • 55
    There are other methods of http authentication, like basic or digest. I suppose it's nice to be able to distinguish them.
    – Cthulhu
    Commented Dec 21, 2015 at 7:57
  • 1
    The question is specifically about Token based authentication, which is usually done after basic authentication so that user doesn't have to provide the username and password with each request.
    – Anmol Gupta
    Commented Dec 21, 2015 at 8:00
  • 1
    I had a similar question as well. I wanted to choose a scheme for a short lived token implementation, which is not fully Oauth 2.0 compliant. I was wondering if i could use Bearer or any non-standard value without getting in trouble with proxies' and servers' interpretation. The closest i came to finding an answer was : stackoverflow.com/questions/7802116/… and stackoverflow.com/questions/8463809/…
    – airboss
    Commented Dec 28, 2015 at 17:26
  • Do servers generally return a token via the same route i.e. "Authorization: Bearer" of the HTTP response? Or is it nearly always part of the response body?
    – w5m
    Commented Jan 20, 2017 at 11:36
  • 3
    This HTTP authentication page on MDN is very useful for the discussion.
    – Ricardo
    Commented Jun 28, 2018 at 22:21

5 Answers 5

Reset to default
303

The Authorization: <type> <credentials> pattern was introduced by the W3C in HTTP 1.0, and has been reused in many places since. Many web servers support multiple methods of authorization. In those cases sending just the token isn't sufficient.

Sites that use the

Authorization : Bearer cn389ncoiwuencr

format are most likely implementing OAuth 2.0 bearer tokens.The OAuth 2.0 Authorization Framework sets a number of other requirements to keep authorization secure, for instance requiring the use of HTTPS/TLS.

If you're integrating with a service that is using OAuth 2.0 it is a good idea to get familiar with the framework so that the flow you're using is implemented correctly, and avoiding unnecessary vulnerabilities. There are a number of good tutorials available online.

Improve this answer
2
  • Thats what i was thinking. Given your knowledge of Bearer Tokens and tokens in general, can you see any security implications by the fact that the API accepts the token without the Bearer keyword?
    – DaRoGa
    Commented Apr 13, 2016 at 8:18
  • 1
    Not really, but I agree with one comment in that question - if their implementation differs on this point, what else is different? That being said there are a number of OAuth-like implementations out there that deviate from the RFCs. It does not automatically mean that their implementations are less secure, though.
    – Vegard
    Commented Apr 13, 2016 at 8:42
66

Long before bearer authorization, this header was used for Basic authentication. For interoperability, the use of these headers is governed by W3C norms, so even if you're reading and writing the header, you should follow them. Bearer distinguishes the type of Authorization you're using, so it's important.

Basic authentication looks like this:

GET /securefiles/ HTTP/1.1
Host: example.com
Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=
Improve this answer
28

The word Bearer wants to provide the authentication scheme. since there are Different Authentication Schemes provided with the Authorization header like:

  • Basic use for http-basic-Authentication
  • Digest MD5 hashed http-basic-authentication (deprecated)
  • Negotiate SPNEGO-based Kerberos for MS Windows Systems
  • AWS4-HMAC-SHA256 used in AWS, specify credential & required service in header (signed)
  • Bearer

& Non Commons are:

  • HOBA HTTP Origin-Bound Authentication, based on digital sinature drafted
  • Mutal
  • VAPID
  • SCRAM
Improve this answer
2
  • 1
    The link authorization schemes points to a authentication scheme, note I think authentication <> authorization
    – soMuchToLearnAndShare
    Commented Jan 21 at 16:26
  • @soMuchToLearnAndShare Thanks for the remark
    – Abilogos
    Commented Jan 22 at 6:52
9

A Bearer Token is set in the Authorization header of every Inline Action HTTP Request and Bearer itself determines the type of authentication.

Ref https://developers.google.com/gmail/markup/actions/verifying-bearer-tokens

Improve this answer
1
  • 15
    This answer is specific to gmail developers, not to all web developers. An 'action' is a gmail concept.
    – aeb0
    Commented Aug 8, 2019 at 1:19
-1

Because "Authorization" already is a reserved word to work in headers (See Mozilla docs), with the syntax <type> <token>. The browsers identify it and work with it, but you are right, you can create your own, for example, MyAuthorization and do MyAuthorization: cn389ncoiwuencr. But some facilities of your server will not know that MyAuthorization is an Authorization header.

I think the better that you do not reinvent the wheel and use "Authorization" with the syntax that is already known.

Improve this answer
1
  • I don't think this answers the question. I don't think you ended up saying what you wanted to say. Do you mean that systems like OAUTH need to add a word to the token because they can't invent their own word? But what about the Mozilla documentation you referenced? It explains that the Bearer word is just part of the scheme. This is covered by another answer. developer.mozilla.org/en-US/docs/Web/HTTP/Headers/…
    – schroeder ♦
    Commented Sep 2, 2022 at 6:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .