Read Bearer Token

Opaque Token

The token is carried as exact opaque text.

highlighted = computed this step

The token is not decoded here

The token row is treated as opaque text after the Bearer scheme.

opaque token checked\text{opaque token checked}
Opaque tokenThe Bearer Authorization header, opaque token bytes, allow-list row, response, and checks are recomputed from pinned bytes.Opaque token - Bearer token matches allow-list user adasectionnamevaluecheckrequest linemethodGETparsedrequest linepath/profileparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorization schemeBearerparsedheaderAuthorization tokentok_7aopaque tokentokendisplaytok_7aopaquetokenexact hex746f6b5f3761pinned bytesallow-listtokentok_7astoredallow-listuser displayadaselectedallow-listmatchyesexact comparestatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckschemeBearerBearerchecktoken matchyesexactcheckselected useradaallow-listchecksent body bytes0empty

The exact token bytes are pinned as hex

The hex row is the exact byte representation used for the compare.

token bytes checked\text{token bytes checked}
Opaque tokenThe Bearer Authorization header, opaque token bytes, allow-list row, response, and checks are recomputed from pinned bytes.Opaque token - Bearer token matches allow-list user adasectionnamevaluecheckrequest linemethodGETparsedrequest linepath/profileparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorization schemeBearerparsedheaderAuthorization tokentok_7aopaque tokentokendisplaytok_7aopaquetokenexact hex746f6b5f3761pinned bytesallow-listtokentok_7astoredallow-listuser displayadaselectedallow-listmatchyesexact comparestatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckschemeBearerBearerchecktoken matchyesexactcheckselected useradaallow-listchecksent body bytes0empty

This is not base-sixty-four decoding

Unlike Basic auth, this toy Bearer example compares the token text exactly.

compare, not decode\text{compare, not decode}
Opaque tokenThe Bearer Authorization header, opaque token bytes, allow-list row, response, and checks are recomputed from pinned bytes.Opaque token - Bearer token matches allow-list user adasectionnamevaluecheckrequest linemethodGETparsedrequest linepath/profileparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorization schemeBearerparsedheaderAuthorization tokentok_7aopaque tokentokendisplaytok_7aopaquetokenexact hex746f6b5f3761pinned bytesallow-listtokentok_7astoredallow-listuser displayadaselectedallow-listmatchyesexact comparestatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckschemeBearerBearerchecktoken matchyesexactcheckselected useradaallow-listchecksent body bytes0empty

Summary

The Bearer token is carried as an opaque value with exact bytes.

token pinned\text{token pinned}
Opaque tokenThe Bearer Authorization header, opaque token bytes, allow-list row, response, and checks are recomputed from pinned bytes.Opaque token - Bearer token matches allow-list user adasectionnamevaluecheckrequest linemethodGETparsedrequest linepath/profileparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderAuthorization schemeBearerparsedheaderAuthorization tokentok_7aopaque tokentokendisplaytok_7aopaquetokenexact hex746f6b5f3761pinned bytesallow-listtokentok_7astoredallow-listuser displayadaselectedallow-listmatchyesexact comparestatusversionHTTP/1.1parsedstatusstatus200 OKokheaderContent-Length0empty bodybodybyte length0countedcheckschemeBearerBearerchecktoken matchyesexactcheckselected useradaallow-listchecksent body bytes0empty