Multiple HTTP Authorization headers?

by

**** UPDATE Feb 2021 *** Please read the comments to this response. Their general conclusion seems to be that some web servers accept multiple Authorization schemes, but that it goes against RFC 7230/7235 ****

This should be possible, you just have to add a comma between field values, e.g:

GET /presence/alice HTTP/1.1 
Host: server.example.com
Authorization: Bearer mF_9.B5f-4.1JqM, Basic YXNkZnNhZGZzYWRmOlZLdDVOMVhk

This is defined in RFC7230, section 3.2.2, Field Order:

A sender MUST NOT generate multiple header fields with the same field name in a message unless either the entire field value for that header field is defined as a comma-separated list [i.e., #(values)] or the header field is a well-known exception (as noted below).

A recipient MAY combine multiple header fields with the same field name into one “field-name: field-value” pair, without changing the semantics of the message, by appending each subsequent field value to the combined field value in order, separated by a comma. The order in which header fields with the same field name are received is therefore significant to the interpretation of the combined field value; a proxy MUST NOT change the order of these field values when forwarding a message.

I don’t know whether all web servers accept this – at the time of writing I’m in the middle of a debate with a colleague about whether it should work or not.

More Related Contents:

  1. Custom HTTP Authorization Header
  2. How to define the basic HTTP authentication using cURL correctly?
  3. What is the maximum length of a URL in different browsers?
  4. Do I need Content-Type: application/octet-stream for file download?
  5. CORS with POSTMAN
  6. How is OAuth 2 different from OAuth 1?
  7. URL matrix parameters vs. query parameters
  8. Detecting the character encoding of an HTTP POST request
  9. Is a 302 redirect to relative URL valid, or invalid?
  10. Do I need a content-type header for HTTP GET requests?
  11. How can I get the clients IP address from HTTP headers?
  12. What is the limit on QueryString / GET / URL parameters
  13. What is the difference between URI, URL and URN? [duplicate]
  14. Is the URL fragment identifier sent to the server? [duplicate]
  15. How many socket connections can a web server handle?
  16. Comparing HTTP and FTP for transferring files
  17. What are proper status codes for CORS preflight requests?
  18. REST response code for invalid data
  19. How big can a user agent string get?
  20. How does cookie “Secure” flag work?
  21. How can I find out whether a server supports the Range header?
  22. REST, HTTP DELETE and parameters
  23. What is the boundary parameter in an HTTP multi-part (POST) Request?
  24. How to send NULL in HTTP query string?
  25. What is the http-header “X-XSS-Protection”?
  26. What is correct HTTP status code when redirecting to a login page?
  27. How to cancel a HTTPRequest in Angular 2?
  28. Is the Content-Length header required for a HTTP/1.0 response?
  29. Correctly switching between HTTP and HTTPS using .htaccess
  30. What is the difference between server side cookie and client side cookie?

Leave a Comment