Authorization
The credential: Bearer tokens, Basic auth. The header that must never end up in logs or URLs.
request header
Example
Authorization: Bearer eyJhbGciOi…
- What it does
- The credential: Bearer tokens, Basic auth. The header that must never end up in logs or URLs.
- In practice
- Two practical traps. Proxies and CDNs often strip or refuse to cache anything carrying it (correctly — a cached authorised response is a data leak). And cross-origin redirects drop it: if your API moved domains and auth mysteriously fails, the client followed a redirect and the header did not.
Works with