4 ms·
Could someone explain to me this whole movement towards "Bearer" authentication? I understand it in an Oauth context and using JWTs. I don't really understand i
by pbreit 5y ago
Could someone explain to me this whole movement towards "Bearer" authentication? I understand it in an Oauth context and using JWTs. I don't really understand it with simple API keys. What is the point of prefixing and API key with "Bearer "?
- detaro 5y agoAn Authorization header value is defined to be a pair of type and the actual authentication/authorization information. "Bearer" works, so why make up something else?
- dolmen 5y agoWhy not a custom HTTP header where the value is the bare token without "Bearer" prefix? I don't see the value of using specifically the Authorization header for machine-to-machine APIs (except to make it easier for man-in-the-middle).
- tobyjsullivan 5y agoA security token with the property that any party in possession of the token (a "bearer") can use the token in any way that any other party in possession of it can. Using a bearer token does not require a bearer to prove possession of cryptographic key material (proof-of-possession). I think most people interpret that definition as including API secret keys. I’d be curious to hear any alternative suggestions as I run into this fairly regularly. https://datatracker.ietf.org/doc/html/rfc6750#section-1.2 https://datatracker.ietf.org/doc/html/rfc6750#section-1.2 Also relevant: https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#authentication_schemes https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentica...