Authentication header required?

[kentmw]

I have been reading about jwt and a few times there has been mention of using the http header Authentication to pass the jwt token to the server. This is especially true when reading about angular and jwt. Yet, I've been using a custom header: x-access-token.

I'm wondering if there is a reason to switch to this header. The documentation about the Authentication header http://tools.ietf.org/html/rfc1945#section-10.2 suggests it's to be used for specific reasons, but I can't tell if it does anything special like encrypt it first.

[willfarrell]

The Authorization header is part of the standard so it makes it easier for others to consume your API with prebuilt plugins. On my current project I allow either headers. I'm using the format Authorization: Bearer TOKEN. The only encryption is done when you use TLS, which should be requires when using JWT on your server.