Token-based authentication not prefixing Token as part of Authorization header

[lombaardcj]

Describe the bug
Token-based authentication with required prefix "Token"

To Reproduce

1. Click Authorize button
2. Enter tokenAuth (apiKey) Value and click Authorize
3. Close Available authorizations pop-up
4. Open any endpoint with a GET that requires TokenAuth
5. Try It Out
6. Execute
   Snippets show the problem already

Expected behavior
Token-based authentication with required prefix "Token" to be sent when making request

[tfranzel]

This has been raised a couple of times and is an issue outside of our control.

• OpenAPI does only support type: http, scheme: basic and type: http, scheme: bearer for this, without any further configuration.
• SwaggerUI hardcodes the bearer prefix to Bearer.
• DRF uses the Token as prefix by default. Afaik this is non-compliant with the standard and create problems all around as you can see.

Advise: Make your life easier and set keyword = 'Bearer' on your TokenAuthentication class.
There is no way we can easily inject a custom prefix. If you are stuck on Token as keyword, there is no other option than using apiKey with a manual handwritten prefix, as described in the auth comment.

I don't like it either, but it is what it is.

[lombaardcj]

Thank you, I thought due to the official mentions from the DRF project towards this project, such a problem would've been easily fixable by now. Fortunately I do have control over the implementation code of the app, and will make changes to follow the better supported Bearer token.

[tfranzel]

It would be easily fixable, but DRF is so stable and so widely used that they are long past the point of changing defaults and creating breaking changes.

I wouldn't recommend using DRF's TokenAuthentication for anything serious anyway, because its super basic and persists the plain secret to the DB.

I have written a better version that uses Bearer and does not store secrets in the DB, which you might want to check out: https://github.com/tfranzel/django-seriously?tab=readme-ov-file#tokenauthentication. Currently in the process of updating other parsts of that lib, but the auth stuff will not change.