"sends a cookie every request. That is really the same" Not exactly, as a cookie a) isn't something you can just read and remember easily (noting that Basic Au

"sends a cookie every request. That is really the same" Not exactly, as a cookie a) isn't something you can just read and remember easily (noting that Basic Auth uses base64-encoding, but that's a pretty flimsy layer of 'protection') b) is only of any use for a single session in a single context. If I see somebody's password while inspecting logs/network traffic etc. there's a decent chance I'll be able to use that information to help me access any number of resources that user might access, at any time. What I don't get is why there's no proposal yet (that I'm aware of) to have browsers automatically send Authorization headers once a bearer token has been established for a particular domain or URL path.