Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I'm building a REST api where clients are authenticated using client certificates. A client in this case is not an individual user, but some sort of a presentation layer. Users are authenticated using a custom approach and it's the responsibility of the presentation layer to see that this is properly done (note: I know this is not the proper approach, but the api is not public).

I would like to pass the user name for each request (not the password), but I'm not sure where to do this. Would it be a good idea to use the Authorization header?

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

I wouldn't recommend that you make non-standard use of a standard HTTP header. Primarily because it can be misleading to other developers that know how the Authoriziation header is meant to be used in HTTP authentication, but also to avoid any potential issues with other parts of your stack having conflicting awareness of the same request header.

Whatever the case, there's nothing preventing you to use a custom, non-standard X-Authorization-User header, specifically for your purposes.

share|improve this answer
    
100% agreed. If you want to do something custom, that's what the X- prefixed headers are for. If you're going to use a standard header, don't use it for anything unusual or unexpected. –  Carson63000 Apr 2 '13 at 20:27
    
Thank you, that was exactly the kind of answer I wanted –  Matsen75 Apr 3 '13 at 7:17
    
Just thought I should mention that the "X-" has been deprecated: stackoverflow.com/questions/3561381/… –  Matsen75 Apr 3 '13 at 8:21
    
Per this answer, does that mean that Amazon S3 is doing it wrong? docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html –  Tom Lianza Mar 3 at 8:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.