Http Header for "Requester"

Question

I'm writing a WCF service, the purpose of which is to authenticate clients using a shared secret key. Each configured client will have it's own unique shared key, that only the client and the service know of. Part of this process means the auth service needs to be able to look up the configured shared key for each client when they request to be authenticated. The service is using the webHttpBinding, so I'd like to use an HTTP header for this if possible.

Is there a better header for the clients of this service to use than the "Referrer" header to declare their identification?

Community · Accepted Answer · 2021-10-07 05:59:28Z

3

Referer is probably not a good choice, as I guess the client will know the URI of the server in advance (hardcoded or from a config), and the standard says:

“The Referer field MUST NOT be sent if the Request-URI was obtained from a source that does not have its own URI”

I think either Authorization with a custom scheme (see also RFC 2617), or a non-standard header like X-Client-Id, would be a reasonable choice.

edited Oct 7, 2021 at 5:59

CommunityBot

11 silver badge

answered Nov 25, 2011 at 15:06

Vasiliy Faronov

12.4k2 gold badges43 silver badges55 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Http Header for "Requester"

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related