My web application need to make call to 3rd party REST API which is protected by Basic authentication on some user click. We are planning to use a technical user for the call.

This will expose the Authorization header in network call in browser dev tools.

How can avoid exposing the authorization header to the user?

2 Answers 2


Anything that runs client-side is unprotected. No matter what kind of protections you employ, a determined client will be able to defeat the protection. Just look at the amount of bots created for abusing big games to earn in-game currency.

You will need to use server-side protection. Use a server-side script to access any third party service, and route everything to your client. This way you can block misbehaving clients, don't publicize the third-party credentials, and don't have issues with CORS.


Short and simple answer: You can't. HTTP headers are sent by the user agent on behalf of the user, and cannot be hidden from the user.

So in a case like this, it's probably better to "proxy" the call to the 3rd party through your own API and rely on the authentication you use for your own users.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .