I am implementing a system for a customer where they are asking me to use a fixed hash to protect the API as authorization. So this fixed value will be sent in the HEADER of the HTTP call as "Authorization":"[the hash]".

Meanwhile, when I was looking for RFC implementations I got to know that Authorization: <type> <credentials> pattern was introduced by the W3C in HTTP 1.0. Can somebody please tell me what I am doing is wrong (going against this standard).

So I was reviewing other APIs using a fixed hash value, and noticed that they are sending this in the URL parameters itself. eg: POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY I would like to know what is the standard they are following.

  • 1
    The best way to clarify requirements that need clarification is to ask the customer. They should know what they actually need. You're right that the Authorization header needs a type and credentials, iana.org/assignments/http-authschemes/http-authschemes.xhtml has a list of schemes (types) that are defined, maybe one of those listed there fits your needs. – Hans-Martin Mosner Mar 31 '20 at 8:01

I would like to know what is the standard they are following.

They are not following any standard. You can put into your URLs whatever you want. Only the format of the URLs are specified, not their content.

You can also put into your headers whatever you want, as long as your web server won't care. Yet if you use standard headers, most web servers will have expectation about their format and content and if you don't fulfill these expectations the web server might deny the request with an appropriate HTTP error code. On the other hand, servers will ignore headers they don't know about, so if you make up your own header, this will not be a problem and is also not forbidden by any standard.

Also interesting to read:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.