I have seen many example with JWT, and all of them have word Bearer.
I have build an auth service on spring(Java) with com.auth0.java-jwt version 3.2.0, and what i'm doing when i'm getting Authentication header from request, that i'm calling requestHeader.substring(7) because this JWT lib needs only token, it don't use this Bearer. So why is this Bearer needed in general?)
JWT why we need Bearer word?
Viewed 1344
1 Answers
Bearer authentication is where you use something you know and send that something to the party you're authenticating to prove your identity. This is called a barer authentication. So when I send you a bearer token, then you potentially have enough information to impersonate me in some context. The JWT standard is flexible enough that more secure strategies are also possible, and so its headers require you to specify which strategy you're using. For example you might prove that you have some specific cryptographic key. That would differ from bearer authentication in that if someone else didn't have that key, they could not generate future requests.
Related