How to attach key/value parameters to the header of a HTTP GET request?

Question

Is there any way to supply key/value parameters of my choice in the headers of a GET request?

Or should I use a POST request for that - even if my request is purely about retrieving information?

Background: I have a RESTful API that requires a key parameter. I want to use this API as the back-end for a JavaScript application on the same domain. However, I don't want users of the web app to be able to see and steal the key parameter, which they would if the key parameter was supplied as a GET parameter.

I think since my site is served over HTTPS, if I put the key parameter in the header, it will be invisible to the web app user, and that gets around my problem.

Answer 1

invisible is probably not possible..

you can do this in Three ways.

1. Either you use Salt and hash for generating random key using sha256/512 and some random secret key in your app and pass through GET request.

2. or can use POST request for same.(easiest method).

3. Use JWT (JSON web tokens). (relatively more secured). Read docs here http://jwt.io/