title: Spring: Authorization header is always null via Angular app
body: <p>I'm building an application with <strong>Spring</strong> and <strong>Angular</strong> and for now, I'm trying to implement the security phase using <strong>Spring security and (JWT)</strong><br>
  The problem is that when I send the <strong>Authorization header</strong> from <strong>Angular</strong> Spring does not receive it!<br>
  even tho I'm sure it's already in the request (from chrome dev tools).<br>
  Also when I send the same request with the same header from <strong>ARC (Advanced REST Client from chrome)</strong> spring receives it and returns the data!<br>
  On then Angular side I'm using the <code>HttpInterceptor</code> of course to add the token to requests like so:</p>
  <pre><code>export class HttpInterceptorService implements HttpInterceptor{
    private _api = `${environment.api}/api`;
    constructor(
      private _authService: AuthenticationService
    ) { }
  
    intercept(req: HttpRequest&lt;any&gt;, next: HttpHandler): Observable&lt;HttpEvent&lt;any&gt;&gt;{
  
      if(req.url.startsWith(this._api)){
        req = req.clone({
          setHeaders: {
            Authorization: `Bearer ${this._authService.getToken()}`
          }
        });
      }
      
      return next.handle(req);
    }
  }
  </code></pre>
  <p><a href="https://i.stack.imgur.com/Y5rct.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Y5rct.png" alt="enter image description here" /></a></p>
  <p>And this is what I'm doing inside spring:</p>
  <pre><code>@Component
  public class JwtRequestFilter extends OncePerRequestFilter {
  
      @Autowired
      private JwtUserDetailsService jwtUserDetailsService;
  
      @Autowired
      private JwtTokenUtil jwtTokenUtil;
  
      private List&lt;String&gt; excludedURLsPattern = Arrays.asList(new String[]{&quot;/authenticate&quot;});
  
      @Override
      protected boolean shouldNotFilter(HttpServletRequest request) throws ServletException {
  
          return excludedURLsPattern
                  .stream()
                  .anyMatch(urlPattern -&gt; request.getRequestURL().toString().contains(urlPattern));
  
      }
  
      @Override
      protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
              throws ServletException, IOException {
  
          System.out.println(&quot;=== request URL: &quot;+request.getRequestURL());
          final String requestTokenHeader = request.getHeader(&quot;Authorization&quot;);
          System.out.println(&quot;=== requestTokenHeader: &quot;+requestTokenHeader);// in this line I always get null (when using Angular not ARC) !!
  
          String username = null;
          String jwtToken = null;
          // JWT Token is in the form &quot;Bearer token&quot;. Remove Bearer word and get
          // only the Token
          if (requestTokenHeader != null &amp;&amp; requestTokenHeader.startsWith(&quot;Bearer &quot;)) {
              jwtToken = requestTokenHeader.substring(7);
              try {
                  username = jwtTokenUtil.getUsernameFromToken(jwtToken);
              } catch (IllegalArgumentException e) {
                  System.out.println(&quot;Unable to get JWT Token&quot;);
              } catch (ExpiredJwtException e) {
                  System.out.println(&quot;JWT Token has expired&quot;);
              }
          } else {
              logger.warn(&quot;JWT Token does not begin with Bearer String&quot;);
          }
  
          // Once we get the token validate it.
          if (username != null &amp;&amp; SecurityContextHolder.getContext().getAuthentication() == null) {
  
              UserDetails userDetails = this.jwtUserDetailsService.loadUserByUsername(username);
  
              // if token is valid configure Spring Security to manually set
              // authentication
              if (jwtTokenUtil.validateToken(jwtToken, userDetails)) {
  
                  UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(
                          userDetails, null, userDetails.getAuthorities());
                  usernamePasswordAuthenticationToken
                          .setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                  // After setting the Authentication in the context, we specify
                  // that the current user is authenticated. So it passes the
                  // Spring Security Configurations successfully.
                  SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken);
              }
          }
          chain.doFilter(request, response);
      }
  
  }
  </code></pre>
  <p>And this is the message I get:</p>
  <pre><code>2020-10-14 15:11:17.664  WARN 9856 --- [nio-5000-exec-1] c.s.c.security.config.JwtRequestFilter   : JWT Token does not begin with Bearer String
  </code></pre>