4

Why by HTTP authentication the HTTP header which contains credentials is called "Authorization"? Any historical explanation?

I am asking because I realized that some people mix authentication with authorization and this name convention by HTTP authentication is bit unfortunate.

Improve this question
1
  • 1
    Now you understand why people mix them. The name is used in RFC 2068 from Jan 1997 and is clearly used only as a synonym of the credentials in the second meaning from the dictionary.
    – techraf
    Commented Aug 17, 2016 at 8:48

1 Answer 1

Reset to default
2

I don't think there is a deeper meaning behind. The usage is consistent with the English language. The Oxford English Learners Dictionary defines authorization as:

  1. [countable] a document that gives somebody official permission to do something.

    Can I see your authorization?

The HTTP specification for headers dates back at least to RFC 2068 from January 1997 which clearly states:

Authorization = Credentials

On the other hand, first security standards that laid ground to ISO 27k series were codified in 1999-2000.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .