Is JWT in Authorization header a standard?

[pmcao]

Hi there,

Great work on django-rest-framework-jwt so far. It is a perfect fit with DRF.
I noticed that you are using JWT in your Authorization header, as in your example:

$ curl -H "Authorization: JWT <your_token>" http://localhost:8000/protected-url/

Is it the recommended way in the current JWT draft? Other server side token framework often accept Bearer instead of JWT, which I think is very common. The reason I am asking because satellizer (an oauth2 token based javascript library for angularjs) does not work with your django-rest-framework-jwt.
I suspect because of the JWT text in the Authorization header. Could you please have a look?

[jpadilla]

@pmcao definitely not a standard, but thanks for this question. We made the decision out of #4. The solution would probably be to make this header prefix configurable to anything, by default it'll probably be kept as JWT.

Thoughts?

[pmcao]

Is there anyway to make the JWT string configurable? Other client side packages are sending Bearer instead of JWT.
Currently, satellizer (https://github.com/sahat/satellizer), a popular angularjs auth client, does not work with django-rest-framework-jwt because of this issue.

[sahat]

It's not difficult for me to make the Authorization header configurable, but this seems like an issue with django-rest-framework and/or django-rest-framework-jwt for not handling this case properly.

[jpadilla]

@sahat It's definitely an issue with this package. My proposal would be to make the header prefix configurable on django-rest-framework-jwt, by default it'll be kept as JWT. You'll be able to set it to Bearer.

[jpadilla]

Please refer to #32.

[jpadilla]

@pmcao @sahat just released a new version that includes a setting to override this. Let me know if you get a chance to test it out.