Authorization Header

Overview

Authorization Header is an HTTP request header used to carry credentials that authorize access to a protected resource, such as a bearer token or another defined authentication scheme. A compromise response for Authorization Header should support rapid revocation, replacement, affected-client identification, and review of prior use.

Key risks include credential leakage through logs or proxies, token replay, incorrect audience validation, header stripping, confused-deputy behavior, and treating authentication as sufficient authorization. The header is only a transport field; security depends on the credential scheme, TLS protection, validation, scope, audience, and server-side authorization policy.

A production implementation should send it only over authenticated TLS, never log full credentials, validate token issuer and audience, apply least privilege, reject unsupported schemes, and prevent forwarding to unintended services.

Useful measures include missing-header rate, invalid-scheme errors, token-validation failures, audience mismatches, replay detections, and unauthorized-request rate. Authorization Header is closely connected to OAuth 2.0, Authentication Error, and Integration Credential. Changes to Authorization Header should preserve overlap or recovery where required while preventing old credentials from remaining active indefinitely.

The Authorization Header boundary should identify the principal, credential or key, permitted audience, scope, lifetime, and revocation path. For Authorization Header, secrets and tokens should remain outside browser bundles, URLs, ordinary logs, and unprotected configuration. Evidence for Authorization Header should record the credential or certificate identifier and decision result without retaining the secret itself.

Monitoring for Authorization Header should track failed use, unusual scope or audience, expiry, rotation status, and attempts involving revoked credentials. The Authorization Header recovery process should restore access without bypassing the original identity and authorization controls.