title: Spring cloud bearer header pass through
body: <p>This seems like a pretty common question, and has a simple answer however implementing the documented solution isn't working for me. </p>
  
  <p>I have a zuul proxy/gateway for all incoming requests which then forwards those onto different micro services. Each incoming request has a correct bearer token set in the header (this is set and validated in the front end  (from okta) and confirmed it works when skipping Zuul and going direct to a service), I just need to pass that onto the micro services.</p>
  
  <p><strong>EdgeServiceApplication</strong></p>
  
  <pre><code>@EnableHystrix
  @EnableZuulProxy
  @EnableEurekaClient
  @EnableOAuth2Sso
  @SpringBootApplication
  public class EdgeServiceApplication {
  
      public static void main(String[] args) {
          SpringApplication.run(EdgeServiceApplication.class, args);
      }
  }
  </code></pre>
  
  <p><strong>Zuul application.yml</strong></p>
  
  <pre><code>server:
    port: 8080
  
  logging:
    level:
      root: INFO
      org.springframework.web: INFO
      org.springframework.security: INFO
  
  zuul:
    sensitiveHeaders: Cookie,Set-Cookie,Authorization
  </code></pre>
  
  <p>And on my micro services, </p>
  
  <pre><code>@EnableEurekaClient
  @SpringBootApplication
  @EnableResourceServer
  public class InstanceServiceApplication {
  
      public static void main(String[] args) {
          SpringApplication.run(InstanceServiceApplication.class, args);
      }
  }
  </code></pre>
  
  <p>When I try and send a request to a micro service through Zuul I get a 401 response. </p>
  
  <p>When adding the following bean to my micro services I can see that there is no Authorisation header set when requests come from Zuul, however I can see it set when calling directly. </p>
  
  <pre><code>@Bean
  public FilterRegistrationBean requestDumperFilter() {
      FilterRegistrationBean registration = new FilterRegistrationBean();
      Filter requestDumperFilter = new RequestDumperFilter();
      registration.setFilter(requestDumperFilter);
      registration.addUrlPatterns("/*");
      return registration;
  }
  </code></pre>
  
  <p>I'm new to Spring so just hoping I've missed something obviouse in a .yml file somewhere? </p>
  
  <p>Current dependencies</p>
  
  <pre><code>buildscript {
  ext {
      springBootVersion = '1.5.8.RELEASE'
  }
  repositories {
      mavenCentral()
  }
  dependencies {
      classpath("org.springframework.boot:spring-boot-gradle-plugin:${springBootVersion}")
      classpath('io.spring.gradle:dependency-management-plugin:0.5.4.RELEASE')
  }
  }
  
  dependencies {
      compile('org.springframework.cloud:spring-cloud-starter-eureka')
      compile('org.springframework.cloud:spring-cloud-starter-config')
      compile('org.springframework.cloud:spring-cloud-starter-zuul')
      compile('org.springframework.cloud:spring-cloud-starter-ribbon')
  
      compile('org.springframework.boot:spring-boot-starter')
      compile('org.springframework.boot:spring-boot-starter-web')
  
      compile('org.springframework.boot:spring-boot-starter-data-rest')
      compile("org.springframework.boot:spring-boot-starter-actuator")
      compile('org.springframework.boot:spring-boot-starter-websocket')
  
      compile('org.springframework.security.oauth:spring-security-oauth2:2.2.0.RELEASE')
      compile('org.springframework.cloud:spring-cloud-security:1.2.1.RELEASE')
  } 
  </code></pre>
  
  <p><strong>Update:</strong></p>
  
  <p>After changing my application as suggested I'm still hitting a 401 on any request. </p>
  
  <pre><code>2017-11-02 11:03:05.697 ERROR 7139 --- [nio-8080-exec-3] o.a.c.c.C.[.[.[/].[dispatcherServlet]    : Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception [Request processing failed; nested exception is org.springframework.web.client.HttpClientErrorException: 401 null] with root cause
  
  org.springframework.web.client.HttpClientErrorException: 401 null
      at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:78) ~[spring-web-4.3.12.RELEASE.jar:4.3.12.RELEASE]
      at org.springframework.web.client.RestTemplate.handleResponse(RestTemplate.java:700)
  </code></pre>
  
  <p>I'm starting to think there is something wrong somewhere else. I have a SecurityConfig class which looks like (not safe for production I know) </p>
  
  <pre><code>@Configuration
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Override
      public void configure(HttpSecurity http) throws Exception {
          http.csrf().disable().antMatcher("/**")
                  .authorizeRequests()
                  .anyRequest().permitAll();
      }
  
      @Bean
      public CorsConfigurationSource corsConfigurationSource() {
          final CorsConfiguration configuration = new CorsConfiguration();
          configuration.setAllowedOrigins(ImmutableList.of("*"));
          configuration.setAllowedMethods(ImmutableList.of("*"));
          configuration.setAllowedHeaders(ImmutableList.of("*"));
          configuration.setAllowCredentials(true);
  
          final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
  
          source.registerCorsConfiguration("/**", configuration);
  
          return source;
      }
  }
  </code></pre>
  
  <p>The only security configuration on my micro services are </p>
  
  <pre><code>@EnableEurekaClient
  @SpringBootApplication
  @EnableResourceServer
  public class InstanceServiceApplication {
  
      public static void main(String[] args) {
          SpringApplication.run(InstanceServiceApplication.class, args);
      }
  
      @EnableGlobalMethodSecurity(prePostEnabled = true)
      protected static class GlobalSecurityConfiguration extends GlobalMethodSecurityConfiguration {
          @Override
          protected MethodSecurityExpressionHandler createExpressionHandler() {
              return new OAuth2MethodSecurityExpressionHandler();
          }
      }
  
      @Bean
      protected ResourceServerConfigurerAdapter resourceServerConfigurerAdapter() {
          return new ResourceServerConfigurerAdapter() {
              @Override
              public void configure(HttpSecurity http) throws Exception {
                  http.authorizeRequests()
                          .anyRequest().authenticated();
              }
          };
      }
  
      @Bean
      public FilterRegistrationBean requestDumperFilter() {
          FilterRegistrationBean registration = new FilterRegistrationBean();
          Filter requestDumperFilter = new RequestDumperFilter();
          registration.setFilter(requestDumperFilter);
          registration.addUrlPatterns("/*");
          return registration;
      }
  }
  </code></pre>
  
  <p><strong>Update #2:</strong></p>
  
  <p>Logging out the request headers, there is still no Authorization</p>
  
  <pre><code>2017-11-02 11:25:24.133  INFO 7381 --- [nio-8080-exec-2] s.s.e.s.c.LoggingRequestInterceptor      : URI         : http://instance-service
  2017-11-02 11:25:24.133  INFO 7381 --- [nio-8080-exec-2] s.s.e.s.c.LoggingRequestInterceptor      : Method      : GET
  2017-11-02 11:25:24.133  INFO 7381 --- [nio-8080-exec-2] s.s.e.s.c.LoggingRequestInterceptor      : Headers     : {Accept=[text/plain, application/json, application/*+json, */*], Content-Length=[0]}
  2017-11-02 11:25:24.133  INFO 7381 --- [nio-8080-exec-2] s.s.e.s.c.LoggingRequestInterceptor      : Request body: 
  </code></pre>
  
  <p><strong>Update #3:</strong></p>
  
  <p>I've made a quick sample application which also strips the authentication headers... <a href="https://github.com/peavers/zuul-oauth-passthrough" rel="nofollow noreferrer">https://github.com/peavers/zuul-oauth-passthrough</a> - Hopefully someone can spot what I've done wrong. </p>