title: Browser-native way to send Bearer token
body: <p>I’m currently reading through <a href="https://www.rfc-editor.org/rfc/rfc6749" rel="nofollow noreferrer">RFC 6749 (“The OAuth 2.0 Authorization Framework”)</a> and <a href="https://www.rfc-editor.org/rfc/rfc6750" rel="nofollow noreferrer">RFC 6750 (“The OAuth 2.0 Authorization Framework: Bearer Token Usage”)</a>.</p>
  <p>I wonder if there is a way to send the <code>Authorization: Bearer ...</code> header from a browser-based client, that automatically links the token to requests, like there is with <code>Authorization: Basic ...</code>, which can be triggered by sending a <code>WWW-Authenticate: Basic realm=&quot;...&quot;</code> in a response. The browser then asks for a username and password and sets the <code>Authorization</code> header automatically in the next request.</p>
  <p>Is there a way to do something similar for bearer tokens? Especially to link the token to a host or similar context that works across page refreshes?</p>
  <p>The reason I’m asking is to avoid an unnecessary delay in having to load and parse some JavaScript that extracts the bearer token from – say – LocalStorage and setting the <code>Authorization</code> header. This would also allow me to have protected assets which are <em>not</em> requested via Ajax or Fetch requests, e.g. images (<code>img</code> tags).</p>
  <p>I know a common workaround is to substitute the bearer token for a session cookie. But I’d like to know if there are other solutions to this problem.</p>