Is it safe to pass username and password in two separate custom header tags in Web services/Web application Post request over https.

How is it different from using from Authorization header.

Which is more safe and what is the difference between passing credentials in header or in the POST body request?

Can is be considered safe to pass sensitive information in the custom header.


The Authorization header is often treated specially by reverse proxies, IDS/IPS, firewalls, web caches, web servers, etc. in regard to information disclosure. The primary concern here is that headers may be logged or cached by intermediate systems if your architecture is more complex than just a single web server running over HTTPS.

If you're just running something simple like an Apache or nginx server with no special logging then I wouldn't consider using an alternative header to be a security issue. In such a setup it's no different to using Authorization or Cookie headers in terms of security.

In general if you have the option to pass sensitive data in a POST request instead of in a header, do so. POST bodies are almost never logged except in debugging scenarios. You also have the benefit of the browser's automatic prompts to avoid accidental resubmission of a form using the browsing history buttons (back, forward), whereas a GET with an authentication header will not trigger this mechanism.


If you properly use HTTPS, there's no difference between a custom header and POST field. The encryption provided by HTTPS will secure the entire traffic the same way for both.

But it's better to stick to the mostly used. An authorization header will be understood by every developer working with your code later, and a custom header will took some time. If you don't document enough, the poor dev will have to read a lot of code to undestand how you authenticate users. Having a username and password fields POST'ed is easy to understand too.

So, even if both approaches have basically the same security, use an authorization header, or POST the authentication.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.