title: Custom Authorization Header
body: <p>I know there is enough content for this question on the Stack Overflow but my subject is not the same as the others. ( Kinda the same but not equal )</p>
  
  <p>I want to hear the community thoughts of what I doing and to see if I can improve somewhere or not.</p>
  
  <p>I'm currently using BASIC Authorization for my login EndPoint as it doesn't require complexity and its over https so its fine the way it is.</p>
  
  <p><strong>Example:</strong></p>
  
  <blockquote>
    <p>GET - /api/login</p>
    
    <p>Authorization : Basic BASE64String(username:password)</p>
  </blockquote>
  
  <p>Some of my EndPoints require Tokens to be granted access to the resource. These Tokens I'm sending trough Headers and Https-Secured.</p>
  
  <p>The thing is I'm not using a conventional method of doing these Authorizations. Some examples below:</p>
  
  <p><strong>Example 1:</strong></p>
  
  <blockquote>
    <p>GET - /api/hardware/{PUBLIC_TOKEN}/getMe </p>
    
    <p>Authorization-Hardware : <strong>PRIVATE_TOKEN</strong></p>
  </blockquote>
  
  <p>This EndPoint doesn't require the Authorization-Hardware Header, but if included more things are done by the API. ( Not relevant here )</p>
  
  <p><strong>Example 2:</strong></p>
  
  <blockquote>
    <p>GET - /api/login/{id}</p>
    
    <p>Authorization-Person : <strong>USER_TOKEN</strong></p>
  </blockquote>
  
  <p>This EndPoint otherwise is necessary including the Authorization-Person Header with the User Token to access the resource. ( Note that how the Token is generated is irrelevant here )</p>
  
  <p><strong>To access the API EndPoints an HTTPS request is necessary.</strong></p>
  
  <p><strong>I gave arbitrary names to the Custom Headers and EndPoints above just to give a picture of what my Authorization Schema is, the names doesn't match the original ones. So don't bother the names just foccus on the schema.</strong></p>
  
  <p>My question is: Not following the convetional way is such a bad thing ? Creating Custom Authorization Headers is bad somehow ( if it is why ? ).</p>
  
  <p>I find this way simpler to give Authorization and a secure way of passing tokens, all these Tokens can be re-generated in the platform again.</p>
  
  <p>Lots of devices and a Mobile Application is already using this Schema, but its all under Development Environment and its not in Production yet. My fear is that this non-conventional way of doing this can affect users of the API in the future. Hope the community thoughts can help me to improve this.</p>
  
  <p><strong>EDIT: 26/03/2017</strong></p>
  
  <p>I would like to know if it would be better and why implementing in the way that is described in the protocol, as its harder to fetch from the Headers when multiple Authorizations is required than when you have a Custom Header and wants to retrieve its value.</p>
  
  <p>Following the Protocol you should use Authorization Header like this:</p>
  
  <pre><code>Authorization: &lt;type&gt; &lt;value&gt;
  </code></pre>
  
  <p><strong>Example:</strong></p>
  
  <blockquote>
    <p>GET - /api/login/{id}</p>
    
    <p>Authorization : User <strong>USER_TOKEN</strong></p>
  </blockquote>
  
  <p>But I just can't see what I gain following this, because when fetching its value would come a String   or in the example case it would return User Token.</p>
  
  <p>Using an Custom Header its way easier validating the Token. Multiple Authorizations can give a headache too following the protocol way.</p>