Does the “Bearer” Authorization header have any special meaning?

Question

Is there a difference between using a "Bearer" Authorization header and using a custom header? For example, the "Basic" Authorization header is different from a custom header because browsers treat "Basic" Authorization headers as a special case (some browsers cache the "Basic" Authorization header). In other words, is "Bearer" just an arbitrary string or do browsers know about it?

If I don't want future browsers to cache my bearer token, should I be safe and use a custom header?

For example, is there a difference between these (assuming my server can handle both):

header('Authorization: Bearer 12345');
header('Mysite-Bearer-Token: 12345');

Answer 1

Bearer token is defined by OAuth 2.0. You can get more details from http://tools.ietf.org/html/rfc6750 .