I am going to create a post request and I am using token why i have to put the token into headers instead of request body? My understanding that body is more secure than http-headers is it so?
or only the reason to put token into headers is to separate and maintain consistency among multiple methods in our API's
Header is more convenient for the server.
Imagine an API where you upload a file as a body for PUT - if token was also in body, you'd have to deal with encoding the body some way to make it clear what is the token and what is the uploaded file.
If body is JSON, you could put token next to the body (in which case you can't just JSON.parse it, you need to again decode how they fit together) or you can bury the token inside the JSON (in which case you have to download the entire JSON and parse it before you can get at the token).
A header can be accessed before the body is downloaded - so if a malicious agent is performing a DoS attack on your server by sending you tons of 100Mb requests, you can detect the lack of proper authorisation as soon as the headers are received, and shut down the connection without having to download and analyse the 100Mb payload.
I can't see any benefit of having token in the body, as opposed to in the header.
There was a discussion of security issues related to passing the data in url vs body. The main point was that urls get logged by intermediate servers more frequently and thus sensitive information could appear in logs.
If we continue this idea for headers/body, I would suggest that headers are more likely to be logged if compared to body. At least in our applications we appear to log requests together with headers.
From cryptography point of view they are all equal as being transferred all together.
