Secret key in Authorization header vs. inside POST body

Question

We have a few in house endpoint that we'd like to keep in house and be used by developers who have access to different servers. We were going to generate a secret key, save the key on the respective servers, and then add it to the cURL request in the Authorization:Bearer header such as:

curl -H "Authorization:Bearer some-token" https://www.some-endpoint.com

to be then verified when the endpoint was hit.

After doing some googling around, I noticed that Stripe uses:

curl https://api.stripe.com/v1/transfers -u sk_some_secret_key -d amount=some_amount -d currency=usd -d destination=some_account

so that the key isn't sent as part of the header. From a security standpoint, is one method more secure than the other?

Answer 1

Both requests are actually quite similar. In either case, the authentication credentials end up in the HTTP request header. You can see this by using the --verbose option with curl.

For the first case:

curl --verbose -H "Authorization:Bearer some-token" https://www.somesite.com/

From the verbose output, you can see that curl includes a header with the name Authorization and the value Bearer some-token in the request header:

> GET / HTTP/1.1
> Host: www.somesite.com
> User-Agent: curl/7.68.0
> Accept: */*
> Authorization:Bearer some-token

The second case uses HTTP Basic Authentication:

curl --verbose https://api.stripe.com/v1/transfers -u sk_some_secret_key -d amount=some_amount -d currency=usd -d destination=some_account

curl prompts for the password to use for HTTP Basic Authentication. Then, from the verbose output, you can see that curl includes a header with the name authorization and the value Basic c2tfc29tZV9zZWNyZXRfa2V5OnRlc3Q= in the request header:

> POST /v1/transfers HTTP/2
> Host: api.stripe.com
> authorization: Basic c2tfc29tZV9zZWNyZXRfa2V5OnRlc3Q=
> user-agent: curl/7.68.0
> accept: */*
> content-length: 56
> content-type: application/x-www-form-urlencoded

c2tfc29tZV9zZWNyZXRfa2V5OnRlc3Q= is the encoded username and password used for HTTP Basic Authentication.

Answer 2

From the security standpoint these ways are about the same:

• in both cases the secret is protected by HTTPS, i.e. no matter of HTTP header or body
• in both cases the secret is visible on the command line, i.e. can be retrieved by an attacker from a leaked script or similar