title: OAuth issue in API gateway
body: <p>I am facing the OAuth issue, details are below:
  I am having two microservices:
  registration-service(<a href="https://github.com/choudharylakshyaveer/registration-service" rel="nofollow noreferrer">https://github.com/choudharylakshyaveer/registration-service</a>)
  student-service(<a href="https://github.com/choudharylakshyaveer/student-service" rel="nofollow noreferrer">https://github.com/choudharylakshyaveer/student-service</a>)</p>
  <p>For these two I have added :
  cloud-config-server(<a href="https://github.com/choudharylakshyaveer/cloud-config-server" rel="nofollow noreferrer">https://github.com/choudharylakshyaveer/cloud-config-server</a>)
  naminig-server(<a href="https://github.com/choudharylakshyaveer/naming-server" rel="nofollow noreferrer">https://github.com/choudharylakshyaveer/naming-server</a>)
  gateway(<a href="https://github.com/choudharylakshyaveer/api-gateway" rel="nofollow noreferrer">https://github.com/choudharylakshyaveer/api-gateway</a>)</p>
  <p>FrontEnd: is at react js: <a href="https://github.com/choudharylakshyaveer/chargie" rel="nofollow noreferrer">https://github.com/choudharylakshyaveer/chargie</a></p>
  <p>For first time use, a new user need to be register that can be done from curl:</p>
  <pre><code>curl --location --request GET 'http://localhost:8765/user/save' \
  --header 'Content-Type: application/json' \
  --data-raw '{
      &quot;username&quot;: &quot;user@chargie.com&quot;,
      &quot;password&quot;: &quot;chaudhary22&quot;,
      &quot;enabled&quot;: true,
      &quot;roles&quot;: [
          &quot;ROLE_ADMIN&quot;,
          &quot;ROLE_USER&quot;
      ]
  }'
  </code></pre>
  <p>To login using the above registered user, below can be run from cUrl:</p>
  <pre><code>curl --location --request POST 'http://localhost:8765/login' \
  --header 'Content-Type: application/json' \
  --data-raw '{
      &quot;username&quot;: &quot;user@chargie.com&quot;,
      &quot;password&quot;: &quot;chaudhary22&quot;
  }'
  </code></pre>
  <p>Once I log In and get the Bearer token, after that I am facing cors issue from the reactJs FE, bu same request is working fine from the Postman, below is request from postman:</p>
  <pre><code>curl --location --request GET 'http://localhost:8765/REGISTRATION-SERVICE/test' \
  --header 'Access-Control-Allow-Credentials: true' \
  --header 'Access-Control-Allow-Headers: content-type' \
  --header 'Access-Control-Allow-Methods: PUT, POST, GET, DELETE, PATCH, OPTIONS' \
  --header 'Access-Control-Allow-Origin: *' \
  --header 'Access-Control-Max-Age: 1800' \
  --header 'Authorization: Bearer eyJhbGciOiJIUzUxMiJ9.eyJyb2xlIjpbIlJPTEVfQURNSU4iLCJST0xFX1VTRVIiXSwic3ViIjoibHZzIiwiaWF0IjoxNjU4OTM0NzIxLCJleHAiOjE2NTg5NjM1MjF9.MN6lCrwLB2bBDBLp-HG4nlSRlyhoR2cQDSRGvJCD2WwDMojhei0wW7xVuDwVCtRUANK02aQMhqagafB2csDWWg'
  </code></pre>
  <h1>Below is the code used to hit request from ReactJs FE:</h1>
  <pre><code>var config = {
              method: 'get',
              url: 'http://localhost:8765/REGISTRATION-SERVICE/test',
              headers: { 
                Authorization: `Bearer ${token}`,
                'Content-Type': 'application/json',
                'Access-Control-Allow-Origin': '*',
                'Access-Control-Allow-Credentials': 'true',
                'Access-Control-Max-Age': '1800',
                'Access-Control-Allow-Headers': 'content-type',
                'Access-Control-Allow-Methods': 'PUT, POST, GET, DELETE, PATCH, OPTIONS'
              },
              Authorization: `Bearer ${token}`
            };
            
            axios(config)
            .then(function (response) {
              console.log(JSON.stringify(response.data));
            })
            .catch(function (error) {
              console.log(error);
            });
  </code></pre>
  <p>And this request gives me CORS issue:
  <a href="https://i.stack.imgur.com/OqS9s.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/OqS9s.png" alt="enter image description here" /></a></p>
  <p>Snippet of the ServerSecurityContextRepository's overridden method used in SecurityContextRepository class of api-gateway:</p>
  <pre><code>@Override
      public Mono&lt;SecurityContext&gt; load(ServerWebExchange swe) {
          ServerHttpRequest request = swe.getRequest();
          HttpHeaders headers = request.getHeaders();
          String authHeader = headers.getFirst(HttpHeaders.AUTHORIZATION);
  
          if (authHeader != null &amp;&amp; authHeader.startsWith(&quot;Bearer &quot;)) {
              String authToken = authHeader.substring(7);
              Authentication auth = new UsernamePasswordAuthenticationToken(authToken, authToken);
              return this.authenticationManager.authenticate(auth).map((authentication) -&gt; {
                  return new SecurityContextImpl(authentication);
              });
          } else {
              return Mono.empty();
          }
      }
  </code></pre>
  <p>Here when the request is coming from the Postman then below is receievd in the <strong><code>headers</code></strong> variable:</p>
  <pre><code>[access-control-allow-credentials:&quot;true&quot;, access-control-allow-headers:&quot;content-type&quot;, access-control-allow-methods:&quot;PUT, POST, GET, DELETE, PATCH, OPTIONS&quot;, access-control-allow-origin:&quot;*&quot;, access-control-max-age:&quot;1800&quot;, authorization:&quot;Bearer eyJhbGciOiJIUzUxMiJ9.eyJyb2xlIjpbIlJPTEVfQURNSU4iLCJST0xFX1VTRVIiXSwic3ViIjoibHZzIiwiaWF0IjoxNjU4OTM0NzIxLCJleHAiOjE2NTg5NjM1MjF9.MN6lCrwLB2bBDBLp-HG4nlSRlyhoR2cQDSRGvJCD2WwDMojhei0wW7xVuDwVCtRUANK02aQMhqagafB2csDWWg&quot;, user-agent:&quot;PostmanRuntime/7.29.0&quot;, accept:&quot;*/*&quot;, postman-token:&quot;6c0d7a9a-dcde-45d7-8422-1476682db9f4&quot;, host:&quot;localhost:8765&quot;, accept-encoding:&quot;gzip, deflate, br&quot;, connection:&quot;keep-alive&quot;]
  </code></pre>
  <p>But when same request comes from Front end then below is receievd in the <strong><code>headers</code></strong> variable and it seems to be malformed:</p>
  <pre><code>[host:&quot;localhost:8765&quot;, connection:&quot;keep-alive&quot;, pragma:&quot;no-cache&quot;, cache-control:&quot;no-cache&quot;, accept:&quot;*/*&quot;, access-control-request-method:&quot;GET&quot;, access-control-request-headers:&quot;access-control-allow-credentials,access-control-allow-headers,access-control-allow-methods,access-control-allow-origin,access-control-max-age,authorization&quot;, origin:&quot;http://localhost:3000&quot;, user-agent:&quot;Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36&quot;, sec-fetch-mode:&quot;cors&quot;, sec-fetch-site:&quot;same-site&quot;, sec-fetch-dest:&quot;empty&quot;, referer:&quot;http://localhost:3000/&quot;, accept-encoding:&quot;gzip, deflate, br&quot;, accept-language:&quot;en-US,en;q=0.9&quot;]
  </code></pre>
  <p>So, Here I am not receiving proper Authorization header on backend's <strong>headers</strong> variable so that I can take Bearer token to validate it.</p>