Is it possible to send two Authorization Header (Bearer and Basic) - ajax

Question

This is how I setup my ajax with Bearer token for Authorization Header:
let headerParams = {
Authorization: "Bearer " + accessToken,
"X-CSRF-TOKEN": $('meta[name="csrf-token"]').attr("content"),
};
let url = "url.com";
$.ajax({
type: "GET",
url: url,
headers: headerParams,
success: function (data) {
},
error: function (error) {
},
});
However on the test server, we also use Basic Auth to access the site. How should I add both Basic and Bearer token in the ajax?
Below is the ajax that works when I only use Basic Authorization Header
let headerParams = {
Authorization: "Basic " + btoa(username + ": " + password),
"X-CSRF-TOKEN": $('meta[name="csrf-token"]').attr("content"),
};
let url = "url.com";
$.ajax({
type: "GET",
url: url,
headers: headerParams,
success: function (data) {
},
error: function (error) {
},
});
I tried adding the Bearer and Basic in headerParams like below:
let headerParams = {
Authorization: "Basic " + btoa(username + ": " + password),
Authorization: "Bearer " + accessToken,
"X-CSRF-TOKEN": $('meta[name="csrf-token"]').attr("content"),
};
But it does not really work since this will overwrite the previous Authorization. I also added Bearer in headerParams while the Basic auth in beforeSend callback, the same error 401 for missing basic auth and 500 in the backend since backend is unable to authenticate user. Most of the SO questions that I have read only uses one or the other.

Answer 1

You may try sending the header as:
Authorization: Bearer <accessToken>, Basic <btoa(username + ": " + password)>
It actually depends more on the server than the client and whether it accepts the multi value. So, please try it out.
According to the spec RFC7230, section 3.2.2, Field Order:
A sender MUST NOT generate multiple header fields with the same field
name in a message unless either the entire field value for that header
field is defined as a comma-separated list [i.e., #(values)] or the
header field is a well-known exception (as noted below).
A recipient MAY combine multiple header fields with the same field
name into one "field-name: field-value" pair, without changing the
semantics of the message, by appending each subsequent field value to
the combined field value in order, separated by a comma. The order in
which header fields with the same field name are received is therefore
significant to the interpretation of the combined field value; a proxy
MUST NOT change the order of these field values when forwarding a
message.