title: Sending session key in the header vs HTTP-Only cookie
body: <p>I would like to know the best option for sending session key in my system.</p>
  
  <p>In my system, there is an API server that is used by web browser, command line interface and desktop apps. It authenticates the user by looking at the <code>Authorization</code> HTTP header.</p>
  
  <p>Currently, the browser stores the session key in the localStorage and attaches it in the <code>Authorization</code> header for requests that require login. However, it was pointed out that a more secure way to store secrets such as session keys is using HTTP-Only cookies.</p>
  
  <p>The problem is that the web browser client will not be able to read the HTTP-Only cookie and put the session key in the HTTP header.</p>
  
  <p>Given the situation, I am thinking about extending the API server to use either one of <code>Authorzation</code> header or cookie to authorize users. Is this a feasible option, and are there alternatives?</p>