title: How to include access-token in the HTTP header when requesting a new page from browser
body: <p>The similar question was asked by someone else (<a href="https://stackoverflow.com/questions/43137291/redirecting-to-a-web-page-from-another-web-page-by-clicking-the-hyperlink-along">here</a>) but got no proper answer. Since this is basic and important for me (and maybe for someone else as well), I'm trying to ask here. I'm using Node.js+Express+EJS on the server side. I struggled to make the token authentication succeeded by using jsonwebtoken at the server and jQuery's ajax-jsonp at the web browser. Now after the token is granted and stored in the sessionStorage at the browser side, I can initiate another ajax request with the token included in the request header, to get the user's profile and display it somewhere in the 'current' page. But what I want is to display a new web page to show the user's profile instead of showing it in the 'current' page (the main/index page of the website). The question is: </p>
  
  <ol>
  <li>How to initiate such an HTTP GET request, including the token in the HTTP header; and display the response as a new web page?</li>
  <li>How the Node.js handle this? if I use res.render then where to put the js logic to verify the token and access the DB and generate the page contents?</li>
  </ol>
  
  <p>Or, should we say the token mechanism is more suitable for API authentication than for normal web page authentication (where the web browser provides limited API)?</p>
  
  <p>I think the answer to this question is important if we want to use the token mechanism as a general authentication since in the website scenario the contents are mostly organized as web pages at the server and the APIs at the client are provided by the browser.</p>
  
  <p>By pure guess, there might be an alternative way, which the ajax success callback to create a new page from the current page with the response from the server, but I have no idea of how to realize that as well. </p>
  
  <p>By calling bellow code successfully returned the HTML contents in <em>customer_profile.ejs</em>, but the client side ajax (obviously) rejected it.</p>
  
  <pre><code>exports.customer_profile = function (req, res) {
    var token = req.headers.token;
    var public_key = fs.readFileSync(path.resolve() + '/cert/public_key.pem');
    var decoded = jwt.verify(token, public_key);
    var sql = 'SELECT * FROM  customer WHERE username = "' + decoded.sub + '"';
    util.conn.query(sql, function (err, rows) {
      if (!err) {
        for (var i = 0; i &lt; rows.length; i++) {
          res.render('customer_profile', {customer_profile: rows[i]});
          break;
        }
      }
    });
  };
  </code></pre>