Styjun

I have a spring boot application with basic spring security enabled. And I have a web application written in Angular JS

When I make a rest call, I can clearly see the Authorization header being passed. But in the server, it displays the header as Null.

P.S This happens only in my machine ( yeh the same old story ) but appears to be working everywhere else.

Request Header

Accept: application/json, text/plain, */*
Authorization: Basic YWRtaW5Ac211LmVkdS5zZzpleUXXXXXXXXXXXSmhaRzFwYmtCemJYVXVaV1IxTG5ObkXXXXXXXXXXXXTmpReGZRLnXXXXXXOExJNF80MjBjMTZMUTFWX2JLR1p1VjM5SmZ3dllXbkxVTmc4LWhEeGJhdXhlMjljc3l5dWVka0w=
Content-Type: application/json
Origin: http://localhost:9000
Referer: http://localhost:9000/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36

Response Header

Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
Connection: Keep-Alive
Content-Length: 68
Content-Type: application/json;charset=UTF-8
Date: Fri, 22 Mar 2019 05:38:23 GMT
Server: NA
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block

Server Copmonent
The server component is built using camel and maven restlet.

from(reslet://routeName)
.log("$in.headers"; // the auth header is completely ignored.

The app is deployed in tomcat and the web.xml has filters as below

<filter>
 <filter-name>CorsFilter</filter-name>
 <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
 <init-param>
 <param-name>cors.allowed.origins</param-name>
 <param-value>*</param-value>
 </init-param>
 <init-param>
 <param-name>cors.allowed.methods</param-name>
 <param-value>GET,POST,PUT,DELETE</param-value>
 </init-param>
 <init-param>
 <param-name>cors.allowed.headers</param-name>
 <param-value>Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization, Cache-Control</param-value>
 </init-param>
 <init-param>
 <param-name>cors.exposed.headers</param-name>
 <param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials</param-value>
 </init-param>

 <init-param>
 <param-name>cors.preflight.maxage</param-name>
 <param-value>10</param-value>
 </init-param>
</filter>
<filter>
 <filter-name>httpHeaderSecurity</filter-name>
 <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
 <async-supported>true</async-supported>
 </filter>
 <filter>
 <filter-name>envHttpHeaders</filter-name>
 <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
 <async-supported>true</async-supported>
 </filter>

 <filter-mapping> 
 <filter-name>envHttpHeaders</filter-name> 
 <url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping> 
 <filter-name>httpHeaderSecurity</filter-name> 
 <url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
 <filter-name>CorsFilter</filter-name>
 <url-pattern>/*</url-pattern>
</filter-mapping>

Am also behind a Corporate proxy. Does it rip off Auth header