The authorization token here is not a cookie. [RFC-7235][1], which defines the Authorization header, states that: > The HTTP authentication framework does not define a single mechanism for maintaining the confidentiality of credentials; instead, each authentication scheme defines how the credentials are encoded prior to transmission. So it depends on the specification of Bearer, which is [RFC-6750][2]. It states: > TLS is mandatory to implement and use with this specification. Which tells me that it should be possible to retrieve it and more importantly, not using TLS here is a vulnurability. [1]: https://tools.ietf.org/html/rfc7235#section-6.1 [2]: https://tools.ietf.org/html/rfc6750#section-1