add support to query string parameter tokens

[rrd108]

Seeking feedback

Query String Tokens

Advantages

• Simplicity: Including the token in the query string is easier to implement, especially for simple API calls.
• Debugging: Tokens in the query string are easier to see and debug in browser developer tools.

Disadvantages

• Security: The biggest drawback is security. Tokens in the query string are visible in the URL, making them susceptible to:
• Interception: An attacker could intercept the token in transit if the communication is not encrypted (HTTPS).
• Accidental exposure: The token could be accidentally leaked in server logs, browser history, or shared URLs.
• Referrer leakage: If the token is included in a URL shared as a referrer, it might be exposed to unintended parties.

Token Headers

Advantages

• Security: Headers are generally considered more secure than query strings because they are not logged in server logs and are not visible in the URL. This is especially important for sensitive tokens like API keys.
• Standardization: The Authorization header is the standard way to send authentication credentials according to the HTTP specification.
• Less error-prone: Including the token in the header avoids the need to manually construct the URL with the token appended.

Disadvantages

• Complexity: Implementing header-based authentication can be slightly more complex compared to simply adding the token to the URL.