REST API Authorization Header or custom Header like X-ABC-Token

Question

Should I used custom HTTP Header to pass JSON web token or HTTP Authorization header in my RESTFul services.

I have already read Custom HTTP Authorization Header but could not understand clearly drawback, if I use header like - X-ABC-Token.

After reading REST Authorization: Username/Password in Authorization Header vs JSON body, I feel Authorization seems good choice.

If I use HTTP Authorization then I believe I can use scheme bearer to achieve this as mentioned in rfc6750

Please suggest me what are the best ways to pass this token in each HTTP request.

Answer 1

You shouldn't expand the standard features of the protocol if the existent ones solve your problem. The correct approach is to define your own authorization scheme for the Authorization header.

You can do something like:

Authorization: MyCompanyLogin token="abcdefg...."

Answer 2

Browsers and proxies already know about the Authorization header. For example, responses to requests with an Authorization header are not cached or are cached just for one user.

In contrast, browsers and proxies don't know about your custom X-ABC-Token header. A proxy may return the same page to different users, even if that header is different. This makes it possible that one user sees the information of another user. This in turn can be disabled by using the header Cache-Control: private.