I'm building a REST api where clients are authenticated using client certificates. A client in this case is not an individual user, but some sort of a presentation layer. Users are authenticated using a custom approach and it's the responsibility of the presentation layer to see that this is properly done (note: I know this is not the proper approach, but the api is not public).I would like to pass the user name for each request (not the password), but I'm not sure where to do this. Would it be a good idea to use the Authorization header?
Custom use of Authorization header in a REST API
rest;authentication;headers
Using the Authorization header seems like the right thing to do. It's the entire purpose of the Authorization header. From http://tools.ietf.org/html/rfc7235#section-4.2 :The Authorization header field allows a user agent to authenticate    itself with an origin server -- usually, but not necessarily, after    receiving a 401 (Unauthorized) response.  Its value consists of    credentials containing the authentication information of the user    agent for the realm of the resource being requested.If you have your own auth scheme document it, but there's no need to reinvent the wheel. 