[csbowe]

It's base64 encoded and put into the header, according to the article.

[colejohnson66]

But if you use HTTPS, those headers are encrypted, right?

[kevin_thibedeau]

The problem is they can end up in the logs of the receiving server and if that gets hacked...