Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm building a REST api where clients are authenticated using client certificates. A client in this case is not an individual user, but some sort of a presentation layer. Users are authenticated using a custom approach and it's the responsibility of the presentation layer to see that this is properly done (note: I know this is not the proper approach, but the api is not public).

I would like to pass the user name for each request (not the password), but I'm not sure where to do this. Would it be a good idea to use the Authorization header?

share|improve this question
up vote 3 down vote accepted

I wouldn't recommend that you make non-standard use of a standard HTTP header. Primarily because it can be misleading to other developers that know how the Authoriziation header is meant to be used in HTTP authentication, but also to avoid any potential issues with other parts of your stack having conflicting awareness of the same request header.

Whatever the case, there's nothing preventing you to use a custom, non-standard X-Authorization-User header, specifically for your purposes.

share|improve this answer
100% agreed. If you want to do something custom, that's what the X- prefixed headers are for. If you're going to use a standard header, don't use it for anything unusual or unexpected. – Carson63000 Apr 2 '13 at 20:27
Thank you, that was exactly the kind of answer I wanted – Matsen75 Apr 3 '13 at 7:17
Just thought I should mention that the "X-" has been deprecated:… – Matsen75 Apr 3 '13 at 8:21
Per this answer, does that mean that Amazon S3 is doing it wrong? – Tom Lianza Mar 3 '14 at 8:34
-1. As mentioned by Zach Dennis, unlike most other HTTP headers, the Authorization header is designed to be extended and there is a clearly specified way on how to define your own authorization scheme. In a nut shell, just make sure you use a custom authorization scheme name. – Lie Ryan Aug 13 '14 at 16:06

To disagree with the accepted answer: using the Authorization header seems like the right thing to do. It's the entire purpose of the Authorization header.

From :

The "Authorization" header field allows a user agent to authenticate itself with an origin server -- usually, but not necessarily, after receiving a 401 (Unauthorized) response. Its value consists of credentials containing the authentication information of the user agent for the realm of the resource being requested.

If you have your own auth scheme document it, but there's no need to reinvent the wheel.

share|improve this answer
It doesn't just seem like the right thing, it is the right thing. (I've been researching this all day) Section 4.1 in RFC 7235 expressly demonstrates use of a custom scheme "Newauth" in the "For instance", along with a standard scheme "Basic" allowing the client to use their choice of either scheme. That said, if you're using a "standard" scheme you should use it correctly. Zach's answer is correct and Filip's is incorrect. – Stephen P Nov 21 '14 at 22:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.