Using an Custom Header its way easier validating the Token. I would like to know if it would be better and why implementing in the way that is described in the protocol, as its harder to fetch from the Headers when multiple Authorizations is required than when you have a Custom Header and wants to retrieve its value.įollowing the Protocol you should use Authorization Header like this: Authorization: īut I just can't see what I gain following this, because when fetching its value would come a String or in the example case it would return User Token. Hope the community thoughts can help me to improve this.

My fear is that this non-conventional way of doing this can affect users of the API in the future. Lots of devices and a Mobile Application is already using this Schema, but its all under Development Environment and its not in Production yet. I find this way simpler to give Authorization and a secure way of passing tokens, all these Tokens can be re-generated in the platform again. My question is: Not following the convetional way is such a bad thing ? Creating Custom Authorization Headers is bad somehow ( if it is why ? ). So don't bother the names just foccus on the schema. I gave arbitrary names to the Custom Headers and EndPoints above just to give a picture of what my Authorization Schema is, the names doesn't match the original ones. To access the API EndPoints an HTTPS request is necessary. ( Note that how the Token is generated is irrelevant here ) This EndPoint otherwise is necessary including the Authorization-Person Header with the User Token to access the resource. This EndPoint doesn't require the Authorization-Hardware Header, but if included more things are done by the API. The thing is I'm not using a conventional method of doing these Authorizations. These Tokens I'm sending trough Headers and Https-Secured. Some of my EndPoints require Tokens to be granted access to the resource. I'm currently using BASIC Authorization for my login EndPoint as it doesn't require complexity and its over https so its fine the way it is.Īuthorization : Basic BASE64String(username:password) I want to hear the community thoughts of what I doing and to see if I can improve somewhere or not. I know there is enough content for this question on the Stack Overflow but my subject is not the same as the others.

Add custom token skrumble