Home/ Questions/Q 1087985
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-16T23:00:44+00:00

For our api user we need two styles of authentication: authenticate the api-user (mobile-device,

  • 0

For our api user we need two styles of authentication:

  • authenticate the api-user (mobile-device, partner integration)
  • authenticate a specific “normal” user, which owns data on our side

The standard challenge vs. response is handled through WWW-Authenticate and Authorization Headers. I want to reuse this.

I have following use-case: On first level we authenticate the api-user (e.g. mobile device), for some api-actions we also need to authenticate a user (e.g. user of mobile device). So we have a special case where we need two authentications schemes “at once”.

Looking at http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html I cannot see that having two different schemes inside one ‘Authorization’ Header is possible.


// I just made up delimiter ';'
Authorization: Digest .... ; CustomXXX ...

Am I correct, if so is there an alternative?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    No, Authorization can only take one set of credentials.

    • 0