How do custom Authorization header schemes (Authorization: Signature ...) function?
❓ Interview Prompt: Explain HTTP Authorization header grammar, custom auth schemes, parameters formatting, and RFC 7235 compliance.
RFC 7235 defines the standard syntax for the HTTP 'Authorization' request header:
$$\text{Authorization} = \text{credentials} = \text{auth-scheme} + \text{SP} + \text{auth-param}$$
While 'Bearer' and 'Basic' are the most common schemes, applications can define Custom Authentication Schemes (e.g. 'Signature', 'Digest', 'HOBA', 'AWS4-HMAC-SHA256'):
'Authorization: AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20260727/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-date, Signature=fe5f...'
Custom schemes specify key-value authentication parameters directly in the header value for complex cryptographic request validation.
Code Implementation Example
function parseCustomSignatureHeader(headerValue: string) {
const [scheme, paramString] = headerValue.split(' ');
if (scheme !== 'Signature') throw new Error('Unsupported Auth Scheme');
const params: Record<string, string> = {};
paramString.split(',').forEach(pair => {
const [key, val] = pair.trim().split('=');
params[key] = val.replace(/"/g, ''); // Strip quotes
});
return { keyId: params.keyId, signature: params.signature };
}Custom Authorization header schemes format key-value parameters according to RFC 7235 for complex API signature validation.