title: HTTP Authorization header consistency in requests
body: <p>HTTP specification says;</p>
  
  <p><em>HTTP access authentication is described in "HTTP Authentication:
        Basic and Digest Access Authentication" [43]. If a request is
        authenticated and a realm specified, the same credentials SHOULD
        be valid for all other requests within this realm (assuming that
        the authentication scheme itself does not require otherwise, such
        as credentials that vary according to a challenge value or using
        synchronized clocks).</em></p>
  
  <p>I don't really understand what this means, but here is my scenario is there anything against HTTP specs here? I use Java Rest service</p>
  
  <ul>
  <li>Client sends username:password using HTTP Authorization header using <strong>HTTP Basic</strong> </li>
  <li>Server sends back a token</li>
  <li>Now client sends a custom authorization token instead of password for further requests <strong>still</strong> in the HTTP authorization header <strong>still</strong> using <strong>HTTP Basic</strong> username:token</li>
  </ul>
  
  <p>Now this does not feel right since what I am really doing with the auth token is NOT an actual HTTP Basic authorization. Also usage of the very same header is inconsistent between requests.</p>
  
  <p>But on the other hand I do not want create yet another custom header for the token exchange. Because its hard to base64 encode them with test tools when you use a custom header. And still inconsistent headers between requests.</p>
  
  <p>Note: these requests refers to different endpoints</p>
  
  <p>What do you advice?   </p>