# Header authentication

As an alternative to configuring Kerberos between the server that hosts the web site and the server that runs QlikView Web Server (QVWS), header authentication can be used. A header is always sent, but to specify which header to send, add the tag Header and a proper value in Web.config:

<add key="Header" value="QVUSER"/>

Example:

```
<configuration>
	<configSections>
		<sectionGroup name="QlikViewWorkBench">
			<section name="General" type="System.Configuration.NameValueSectionHandler" require-Permission="false" />		
		</sectionGroup>
	</configSections>
	<QlikViewWorkBench>
		<General>
			<add key="Proxy" value="/Proxy.aspx" />
			<add key="LogFile" value="wb.log" />
			<add key="Header" value="QVUSER" />
			<add key="QvAjaxZfcPath" value="http://<SERVERNAME>/QvAjaxZfc" />
		</General>
	</QlikViewWorkBench>
</configuration>
```

In the example above, a header with the value QVUSER\&lt;user that is logged in&gt; is sent to QVWS.

Information noteSince headers can be manipulated, it is important to protect the communication between the web site and QVWS.