Does encrypting HTTP header value provide additional security?

Question

Payload before encryption :

HTTP/1.1 200 OK
Authorization: password
Content-Encoding: UTF-8
Content-Length: 138

{ "command" : "delete all records" }

Payload after encrypting Authorization header :

HTTP/1.1 200 OK
Authorization: spxnxkoJX+O1iatF6gco9Q==
Content-Encoding: UTF-8
Content-Length: 138

{ "command" : "delete all records" }

Protocol is NOT over SSL.

EDIT

In our project, my senior added this extra layer of security(as per his opinion), with which I am not agree. As per my opinion, this will add an extra cost of encryption and decryption of header value and without any security benefit.

I want to ensure, if he is really right?

Answer 1

Does encrypting HTTP header value provide additional security?

There is no general response for this but it depends on what exactly you are doing and what kind of "additional security" you aim for.

In your case it looks that you just replaced a plain text password with an encrypted password. Unless you have some replay protection baked into your unknown encryption algorithm the attacker could just sniff your encrypted password and replay it later. Which means it does not really provide additional security if your goal is to make authentication more secure. If your goal is instead to only hide the plain text password to make password reuse attacks harder then encryption might help.