title: Is it safe to send authorization header from a server to client?
body: <p>I'm setting up a new app. Everything is through non-HTTPS. Just HTTP. Anyway, after the user logs in the server sends the client a nice 200, and this:</p>
  
  <pre><code>{
  "user": {
      "_id": "5595bb294cbed176e7594e79",
      "username": "ckent1000",
      "email": "clarkcando@gmail.com",
      "roles": {
          "account": {
              "id": "5597089bbde23bf2179dba46",
              "name": "superman"
          }
      }
  },
  "session": {
      "userId": "5595bb294cbed176e7594e79",
      "key": "6c5c2ed4-77f9-4038-b175-e9fb927c1b22",
      "time": "2015-07-06T14:31:58.175Z",
      "_id": "559a915e53723a85eaf75ea9"
  },
  "authHeader": "Basic NTU5YTkxNWU1MzcyM2E4NWVhZjc1ZWE5OjZjNWMyZWQ0LTc3ZjktNDAzOC1iMTc1LWU5ZmI5MjdjMWIyMg=="
  </code></pre>
  
  <p>}</p>
  
  <p>Is that cool? My sage wisdom suggests that it's not because this is over HTTP.</p>