title: Spring security and Stomp not seeing headers
body: <p>I have a spring security application and I'm trying implement websockets using Stomp. </p>
  
  <p>The application is mainly REST based, using tokens for security. All requests coming in have to a security token in the header.</p>
  
  <p>The problem is when setting up a simple Stomp client using basic html, spring appears to not be seeing any headers.</p>
  
  <p>The client works fine if I disable the security, in which case no headers are passed in. </p>
  
  <pre><code>var socket = new SockJS('http://localhost:8080/project/ws/wsendpoint');
  var headers = {'Auth': 'some_auth_token'}
  writeConsole("Created socket");
  stompClient = Stomp.over(socket);
  stompClient.connect(headers, function(frame) {
      writeConsole("Connected to via WebSocket");
      stompClient.subscribe('/topic/push', function(message) 
          { writeConsole(message.body);}, headers );
      });
  window.onbeforeunload = disconnectClient;
  </code></pre>
  
  <p>Heres the relevant spring configuration </p>
  
  <pre><code>protected void configure(final HttpSecurity http) throws Exception {
          http
              .csrf().disable()
              .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS) 
              .and()
              .headers().frameOptions().sameOrigin()
              .and()
              .authorizeRequests()
              .anyRequest().authenticated() authenticated.
              .and()
              .anonymous().disable()
              .exceptionHandling().authenticationEntryPoint(authenticationEntryPoint()); 
  
          http.addFilterBefore(authenticationTokenFilter(), BasicAuthenticationFilter.class);
      }
  </code></pre>
  
  <p>The doFilter in the authenticationTokenFilter class should see the header field 'Auth', as set in the client, however nothing is there.</p>