Creates a middleware authenticating requests with the Bearer scheme.
Decorates a Fetch implementation with one adding an Authorization header carrying token to every request,
alongside the headers supplied by the caller; credentials already carried by the request are replaced, so the
middleware is best applied to a client dedicated to a single origin.
Requests are normalised as Request objects before the
header is attached, preserving the headers and the options carried by a Request input alongside the overrides
supplied through init.
A token supplied as a string is validated and encoded as the header value once when the middleware is created,
leaving nothing to compute on the request path. A token supplied as a function is resolved and validated on every
request, against the request as it is about to be sent, and may be returned either directly or as a promise: tokens
rotated elsewhere, as expiring OAuth ones are, are picked up without assembling a new client, and requests are
authenticated as their target requires. A supplier reporting a malformed token, or failing altogether, rejects the
exchange without sending it.
Warning
A bearer token is a bearer credential in the literal sense: whoever holds it may use it. Confine it to https
exchanges, as RFC 6750 § 5.3 requires.
Creates a middleware authenticating requests with the
Bearerscheme.Decorates a Fetch implementation with one adding an
Authorizationheader carryingtokento every request, alongside the headers supplied by the caller; credentials already carried by the request are replaced, so the middleware is best applied to a client dedicated to a single origin.Requests are normalised as
Requestobjects before the header is attached, preserving the headers and the options carried by aRequestinput alongside the overrides supplied throughinit.A token supplied as a string is validated and encoded as the header value once when the middleware is created, leaving nothing to compute on the request path. A token supplied as a function is resolved and validated on every request, against the request as it is about to be sent, and may be returned either directly or as a promise: tokens rotated elsewhere, as expiring OAuth ones are, are picked up without assembling a new client, and requests are authenticated as their target requires. A supplier reporting a malformed token, or failing altogether, rejects the exchange without sending it.
A bearer token is a bearer credential in the literal sense: whoever holds it may use it. Confine it to
httpsexchanges, as RFC 6750 § 5.3 requires.