I don't understand why "no cookies" is listed under "pros". This works exactly like a session cookie (a header attached to every request to the domain), the only difference is that the header contains your actual plain-text credentials instead of a token. It is at most as secure/safe/non-invasive as a cookie, and in a lot of situation, a lot less.
The obvious way to improve it would be to offer a way for the browser to load a custom form to authenticate and get the (hashed) credentials to present to the original website in the header. And then you have recreated session cookies in full.
Comments
I don't understand why "no cookies" is listed under "pros". This works exactly like a session cookie (a header attached to every request to the domain), the only difference is that the header contains your actual plain-text credentials instead of a token. It is at most as secure/safe/non-invasive as a cookie, and in a lot of situation, a lot less.
The obvious way to improve it would be to offer a way for the browser to load a custom form to authenticate and get the (hashed) credentials to present to the original website in the header. And then you have recreated session cookies in full.