Read Bearer Token

Bearer Header

The Authorization header names the Bearer scheme.

highlighted = computed this step

The request asks for the profile path

The request line is parsed before the auth header is read.

GET /profile\text{GET /profile}
Bearer headerThe Bearer Authorization header, opaque token bytes, allow-list row, response, and checks are recomputed from pinned bytes.Bearer header - Bearer token matches allow-list user adasectionnamevaluecheckrequest linemethodGETparsedrequest linepath/profileparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorization schemeBearerparsedheaderAuthorization tokentok_7aopaque tokentokendisplaytok_7aopaquetokenexact hex746f6b5f3761pinned bytesallow-listtokentok_7astoredallow-listuser displayadaselectedallow-listmatchyesexact comparestatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckschemeBearerBearerchecktoken matchyesexactcheckselected useradaallow-listchecksent body bytes0empty

Authorization starts with Bearer

The Authorization scheme row says Bearer.

scheme=Bearer\text{scheme}=\text{Bearer}
Bearer headerThe Bearer Authorization header, opaque token bytes, allow-list row, response, and checks are recomputed from pinned bytes.Bearer header - Bearer token matches allow-list user adasectionnamevaluecheckrequest linemethodGETparsedrequest linepath/profileparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorization schemeBearerparsedheaderAuthorization tokentok_7aopaque tokentokendisplaytok_7aopaquetokenexact hex746f6b5f3761pinned bytesallow-listtokentok_7astoredallow-listuser displayadaselectedallow-listmatchyesexact comparestatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckschemeBearerBearerchecktoken matchyesexactcheckselected useradaallow-listchecksent body bytes0empty

The Host row names api.example

The toy request stays on one pinned API host.

Host=api.example\text{Host}=\text{api.example}
Bearer headerThe Bearer Authorization header, opaque token bytes, allow-list row, response, and checks are recomputed from pinned bytes.Bearer header - Bearer token matches allow-list user adasectionnamevaluecheckrequest linemethodGETparsedrequest linepath/profileparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorization schemeBearerparsedheaderAuthorization tokentok_7aopaque tokentokendisplaytok_7aopaquetokenexact hex746f6b5f3761pinned bytesallow-listtokentok_7astoredallow-listuser displayadaselectedallow-listmatchyesexact comparestatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckschemeBearerBearerchecktoken matchyesexactcheckselected useradaallow-listchecksent body bytes0empty

Summary

The header has a scheme and then an opaque token.

Bearer header parsed\text{Bearer header parsed}
Bearer headerThe Bearer Authorization header, opaque token bytes, allow-list row, response, and checks are recomputed from pinned bytes.Bearer header - Bearer token matches allow-list user adasectionnamevaluecheckrequest linemethodGETparsedrequest linepath/profileparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorization schemeBearerparsedheaderAuthorization tokentok_7aopaque tokentokendisplaytok_7aopaquetokenexact hex746f6b5f3761pinned bytesallow-listtokentok_7astoredallow-listuser displayadaselectedallow-listmatchyesexact comparestatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckschemeBearerBearerchecktoken matchyesexactcheckselected useradaallow-listchecksent body bytes0empty