HTTP X-Auth-Token versus HTTP Authorization

[Mitrixsen]

Hello, everyone.

I am early into automation for my ENCOR 350-401 exam and I have a question.

When we work with HTTP/HTTPs when making REST API calls, the Authorization header is used to provide authentication parameters such as username/password.

When sending API calls to Cisco Catalyst Center in the Devnet Sandbox, you must first pass in credentials that will generate a token. You then use this token to authenticate yourself for any further requests.

When providing the token, why can't I just use the Authorization header and insert the token there?

Why is X-Auth-Token necessary instead? How does the operation differ? Why does one work but not the other one?

Thank you.

David

[bigevilbeard · Accepted solution]

Hey @Mitrixsen design choice for this API. Many APIs use the standard auth bear way, but you still find many enterprise systems using custom headers like this.

If you did put the same token in the auth header instead, the servers authentication code just opts to ignores it, as its not checking that header location for tokens and the middleware does not even look at auth header during its token validation process.

Hope this helps.