Add ability to specify the token location in request headers

🚀 Feature Proposal

Currently the default, non-configurable behavior for tokens sent with headers (meaning, not in cookies) is hardcoded to look for the token in the Authorization header with format Bearer {token}. It should be possible to specify a custom location and format for the token in the headers. For instance, a custom header, and a custom format not necessarily involving Bearer.

Motivation

JWT doesn’t prescribe a way to send a token to an API, so it should be possible to provide a custom location where the token is retrieved from and validated.

Example

The custom logic should override these lines of code, and could be provided as an option to the plugin via a callback which is used to extract the token from the request, for instance:

extractToken: request => token

[thomheymann]

Makes sense, I’ll have a look at this today

[simoneb]

An existing application that’s sending the token in a custom request header and sending it in this way to other existing microservices. We’re creating a new microservice based on fastify and we can’t change the way the token is sent to the services.