Should the token in the header be base64 encoded?

[bojanz]

The spec is not clear about this, and the examples don't look encoded.
However, the spec points you to http://tools.ietf.org/html/rfc6750#section-2.1
which says:

The syntax of the "Authorization" header field for this scheme
follows the usage of the Basic scheme defined in Section 2 of
[RFC2617]. Note that, as with Basic, it does not conform to the
generic syntax defined in Section 1.2 of [RFC2617] but is compatible
with the general authentication framework being developed for
HTTP 1.1 [HTTP-AUTH], although it does not follow the preferred
practice outlined therein in order to reflect existing deployments.
The syntax for Bearer credentials is as follows:

b64token    = 1*( ALPHA / DIGIT /
                  "-" / "." / "_" / "~" / "+" / "/" ) *"="

credentials = "Bearer" 1*SP b64token

So does b64token in this case mean it should be encoded? It also points to Authorization: Basic where the credentials are base64 encoded.

[bshaffer]

This is definitely unclear. Base64 is usually implemented to bypass issues such as escaping characters in a URL. Tokens do not contain such characters (to my knowledge), and can be passed in the header, where such problems don't apply. I imagine this is handled per-implementation.

[bshaffer]

Here is at least one example of base64-encoding being removed:

https://github.com/lncd/OAuth2/pull/12/files

[bojanz]

Yeah, links in that PR confirm that base64 encoding is not required, though I think it would have been clearer for the spec to require it. Oh, well.
Thanks for clarifying.

[bshaffer]

Yeah, this answer says it all, and is super helpful

On casual reading of "The OAuth 2.0 Authorization Protocol: Bearer
Tokens"* I've encountered several people (including myself) who have
made the assumption that the name b64token implies that some kind of
base64 encoding/decoding on the access token is taking place between
the client and RS.
Digging a bit deeper in to "HTTP/1.1, part 7: Authentication"**,
however, I see that b64token is just an ABNF syntax definition
allowing for characters typically used in base64, base64url, etc.. So
the b64token doesn't define any encoding or decoding but rather just
defines what characters can be used in the part of the Authorization
header that will contain the access token.

[Kavindu-Dodan]

Doesn't it say to use base64 encoding. This phrase, "The syntax of the "Authorization" header field for this scheme follows the usage of the Basic scheme defined in Section 2 of [RFC2617]" points out to base64 encoding. As per RFC2617, Basic schema encode username password in base64 encoding.