Search code examples
httpoauth-2.0github-apihttp-authentication

Why the authentication scheme of GitHub Oauth2 Authorization header is 'token' not 'Bearer'?


According to the RFC6750, the HTTP Authentication Scheme should be 'Bearer'. But this GitHub doc uses 'token' as the scheme. I've tried both and it seems that both of those two are working.

My question is:

  1. Is there any reason why GitHub uses 'token' rather than the standard?
  2. Is this scheme can be any thing as long as the server can understand?

Solution

  • A protocol (like RFC6750) is just a common standard that multiple parties agree on, so fundamentally, yes it can be anything as long as the client and server agree on it.

    OAuth in particular has lots of extensions - implementers doing things that are not quite to spec, or perhaps left ambiguous or open-ended in the spec. Treatment of refresh tokens is an area where you see this a lot.

    As for GitHub, I suspect that they support the token header because they allow that header to be used for other kinds of tokens beyond OAuth tokens, specifically personal access tokens and GitHub App tokens.

    In addition, it's likely that at least some of these uses (particularly the personal access tokens) were in use before the RFC you linked was published.