REST API Design: Should I use a custom header or Authorization for some sensible information?

CallMePixelMan 0
Viewed 37

this is my first question on StackOverflow.

I'm currently creating a Discord Bot with a Dashboard and a private API for my service.
The flow I'm trying to create is the following

User logs in with Discord OAuth2 and gets his access_token
-> Client stores his access_token
   -> When doing an action on the Dashboard and commit it, make an API call and pass his access_token
      -> My API then check if he has the permission to commit it
         (by doing a request to Discord's API with his access_token)
      -> Realise the action if allowed

Because the user needs to send his access_token, I need to know how I'm supposed to recieve and use it safely, and following the best practices.

Those are the two way I found :

  • Use a custom HTTP Header like Discord-Access-Token: <access_token> and then process-it easly
  • to use Authorization: Baerer <access_token> (even tho this is not an Authorization but something I need to check if the user is allowed to use the API). + This is not really following the flow in FastAPI...

Does someone knows what is the best thing to use? Thanks in advance!

header http rest fastapi
2 Answers

even tho this is not an Authorization but something I need to check if the user is allowed to use the API

So Authorization in simple terms...

Think of your service as something that covers everything you do even doing stuff with tokens on Discord.

I would use the Authorization header, because it is standard, unless you have another token, because you cannot send multiple ones in a single request except if you package them together. If you have a different header, then the request can be modified or cached by proxies. https://stackoverflow.com/a/43164958/607033

As far as I understand Basic and Bearer are not the only types of Authorization, you can have a custom type too. If Bearer does not cover the term you need, then write something like DiscordOAuth2.

inf3rno0

The Authorization header name is a misnomer, in the same category as the misspelling as 'Referrer'. The purpose of the Authorization header is actually authentication.

Also not that it's Bearer not Baerer.

userD4l0
Related