Why is the Token manually added to the header of the request, usually using the "Authorization" field?

Why is the Token manually added to the header of the request, usually using the "Authorization" field?

The main reasons why Token is usually placed in the "Authorization" field are as follows:

1. Standardization: The HTTP protocol defines some common header fields, such as "Authorization", which are used to convey authentication-related information. In this way, placing the Token in the "Authorization" field complies with the specifications of the HTTP protocol.

2. Clear semantics: The meaning of the "Authorization" field is to authenticate and authorize requests, so placing Token in this field can express its role more clearly.

3. Security considerations: Placing the Token in the "Authorization" field helps prevent the leakage of sensitive information, because this field is usually related to authentication, and both the client and the server will perform special processing on it, such as encrypted transmission and will not be browsed. Server cache, etc.

It should be noted that it is not mandatory to place the Token in the "Authorization" field. Developers can also choose other customized fields to pass the Token. But using the "Authorization" field is a common practice, provides better readability and semantic expression, and is compatible with multiple authentication and authorization mechanisms.

code

The following is a code example that uses JavaScript to manually add the Token to the header of the request and uses the "Authorization" field:

const url = "http://example.com/api/resource";
const token = "your_token_here";

fetch(url, {
    
    
  method: "GET",
  headers: {
    
    
    Authorization: `Bearer ${
      
      token}`
  }
})
  .then(response => {
    
    
    console.log("Response Code: " + response.status);
    // 这里可以对响应进行处理
  })
  .catch(error => {
    
    
    console.error("Error:", error);
  });

In this example, we use the fetch function to initiate a GET request and manually add the "Authorization" field through the headers attribute. Note that the string interpolation syntax${token} is used to insert the Token value into the request header.

Please make sure to replace http://example.com/api/resource with your actual request URL and your_token_here with a valid Token string. In addition, you may need to adjust the request method (such as GET, POST, etc.) and other request parameters as needed.

Please note that in some cases, setting the "Authorization" header field directly in JavaScript code may be restricted by cross-origin requests due to browser security policy restrictions. In this case, you may need to configure cross-origin requests or proxy requests on the server side.