> GET https://haveibeenpwned.com/api/v3/breachedaccount/test@examp...
> hibp-api-key: [your key]
Wouldn't the standard Authorization: Bearer <key> header be more compliant?
> There's a couple of these and they're largely due to me trying to make sure I get this feature out as early as possible and continue to run things on a shoestring cost wise
Using the Authorization header can cause significant problems with both clients and servers, and also might unintentionally permit browsers to directly query the server if they can be convinced to provide a bearer token.
Using a custom HTTP header sidesteps both client and server issues altogether and closes the door on browsers direct-querying the API, which could be considered a positive by the site operator.
That same section of the document describes other scenarios, like a hosted service or a CLI tool, that do not involve a proxy service.
Edit for clarity: A bearer token [0] is a concept for OAuth. This is not OAuth.
Like it or not, there is an rfc for this and using it for anything else would be code smell at best
> Like it or not, there is an rfc for this and using it for anything else would be code smell at best
No but every OS that uses windows can call them windows....
Can you link to any tool which uses bearer tokens and doesn't grant them through oauth2?
Or it's internal, please explain how the token is obtained.
I haven't seen any to date but I guess I could be wrong
These are bearer tokens, in that the bearer gets granted access by that token alone.
You happen to send it along in a Basic authentication in HTTP instead of as an Authorization header, but it is a bearer token all the same.
No OAuth2 flow required.
Yes: https://www.pelion.com/docs/device-management/current/integr...
(I know I've seen and used many others, but Pelion comes first to mind because I used to work on it.)
Authorization: Bearer <API Key>.