Purpose of auth-scheme in HTTP Authorization header
<p>I have a question regarding the <code>auth-scheme</code>. I stumble across JSON Web Tokens and one of the official page: </p>

<p><a href="https://jwt.io/introduction/" rel="nofollow noreferrer">https://jwt.io/introduction/</a></p>

<p>They use </p>

<pre><code>Authorization: Bearer &lt;token&gt;
</code></pre>

<p>In the past, I am familiar with the <code>Authorization: JWT &lt;token&gt;</code> and had assume that was correct until today, I read the official JWT webpage and they used <code>Bearer &lt;token&gt;</code> instead.</p>

<p>I was testing the Knock Rails gem: <a href="https://github.com/nsarno/knock" rel="nofollow noreferrer">https://github.com/nsarno/knock</a> and with this library, I was able to make a Postman request to my Rails API with random auth-scheme:</p>

<p><a href="https://i.stack.imgur.com/xs5z4.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/xs5z4.png" alt="example 1"></a></p>

<p>I could even get rid of the auth-scheme completely:</p>

<p><a href="https://i.stack.imgur.com/bTPG9.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/bTPG9.png" alt="example 2"></a></p>

<p>When I remove my JWT token from the Authorization header, however, it returns 401 Unauthorized response as expected, so I know it's...working?</p>

<p><a href="https://i.stack.imgur.com/qjZOO.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/qjZOO.png" alt="example 3"></a></p>

<p>So I began to think...is there a purpose to the auth-scheme ?</p>

<p>Is a library or web server suppose to honour/respect/enforce the correct usage of auth-scheme in the Authorization header?</p>

<p>I came across this Stackoverflow post in my quest for answer:</p>

<p><a href="https://stackoverflow.com/questions/7802116/custom-http-authorization-header">Custom HTTP Authorization Header</a></p>

<p>It showed the official format is:</p>

<pre><code>credentials = auth-scheme #auth-param
</code></pre>

<p>The example given was even more bizarre:</p>

<pre><code>Authorization: FIRE-TOKEN apikey="0PN5J17HBGZHT7JJ3X82", hash="frJIUN8DYpKDtOLCwo//yllqDzg="
</code></pre>

<p>I don't know if this qualifies as a programming question. I can blindly follow/use a third party library. </p>

<p>What's the purpose of the auth-scheme ?</p>

<p>I'm no cryptography/computer security expert.</p>

<p>Maybe someone can shed some light on the issue (or maybe non-issue?) ?</p>