How can I set SSE request authorization header?

Server-Sent Events (SSE) is a server-push technology that allows servers to send events to clients through a unidirectional HTTP connection. When using SSE, authentication information is typically set via HTTP requests from the client to the server.

On the client side, you can set the authorization header when establishing the SSE connection. For example, when using the EventSource interface in JavaScript, you cannot directly set HTTP headers in the constructor because the standard EventSource API does not support custom request headers. Instead, a common practice is to send the token in the query string or use a polyfill that supports setting HTTP request headers for EventSource.

If you choose to send the token in the query string, it might look like this:

javascript
const token = 'your_token_here';
const url = `http://example.com/events?token=${encodeURIComponent(token)}`;
const eventSource = new EventSource(url);

eventSource.onmessage = function(event) {
    // Handle incoming messages
};

However, this method is not the most secure because the token may be exposed in server logs and is more vulnerable to CSRF attacks.

To send the token more securely, some developers might choose to use a polyfill that supports custom HTTP request headers for EventSource. For example, with the eventsource polyfill, you can do:

javascript
const EventSource = require('eventsource');
const url = 'http://example.com/events';
const eventSource = new EventSource(url, {
    headers: {
        'Authorization': `Bearer your_token_here`
    }
});

eventSource.onmessage = function(event) {
    // Handle incoming messages
};

The server needs to validate this Authorization header to determine if the client has permission to receive the event stream.

In practice, you may also need to consider Cross-Origin Resource Sharing (CORS) policies to ensure the browser allows setting these headers from client-side code.

This is how to set authorization headers in SSE requests. Note that each method has its use cases and security considerations. In practice, you need to choose based on specific requirements and security standards.