I’m building a REST api where clients are authenticated using client certificates. A client in this case is not an individual user, but some sort of a presentation layer. Users are authenticated using a custom approach and it’s the responsibility of the presentation layer to see that this is properly done (note: I know this is not the proper approach, but the api is not public).
I would like to pass the user name for each request (not the password), but I’m not sure where to do this. Would it be a good idea to use the Authorization header?
Using the Authorization header seems like the right thing to do. It’s the entire purpose of the Authorization header.
From https://www.rfc-editor.org/rfc/rfc7235#section-4.2 :
The “Authorization” header field allows a user agent to authenticate
itself with an origin server — usually, but not necessarily, after
receiving a 401 (Unauthorized) response. Its value consists of
credentials containing the authentication information of the user
agent for the realm of the resource being requested.
If you have your own auth scheme document it, but there’s no need to reinvent the wheel.
1
I wouldn’t recommend that you make non-standard use of a standard HTTP header. Primarily because it can be misleading to other developers that know how the Authoriziation header is meant to be used in HTTP authentication, but also to avoid any potential issues with other parts of your stack having conflicting awareness of the same request header.
Whatever the case, there’s nothing preventing you to use a custom, non-standard X-Authorization-User header, specifically for your purposes.
5