title: HTTP status code 401 even though I’m sending credentials in the request
body: <p>Recently i have introduced JWT authentication to my Springboot and Angualr2 based App.
  In There i tried to do a POST request by passing the JWT token as below in my Angualr code</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>save(jobId: number, taskId: number, note: Note) {
  
     return this.http.post(environment.APIENDPOINT + '/jobs/' + jobId + '/tasks/' + taskId + '/notes', note, this.setHeaders()).map((response: Response) =&gt; response.json());
  
  }</code></pre>
  </div>
  </div>
  </p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>private setHeaders() {
          // create authorization header with jwt token
          let currentUser = JSON.parse(localStorage.getItem('currentUser'));
          console.log("Current token---"+ currentUser.token);
          if (currentUser &amp;&amp; currentUser.token) {
  
    let headers = new Headers();
    headers.append('Content-Type', 'application/json');
    headers.append('authorization','Bearer '+ currentUser.token);
              
     let r = new RequestOptions({ headers: headers })
     return r;
  
          }
      }</code></pre>
  </div>
  </div>
  </p>
  
  <p>However in the server side it returns status code 401. The issue is in the Springboot side it checks the authorization header as below and it returns null</p>
  
  <pre><code>String authToken = request.getHeader("authorization ");
  </code></pre>
  
  <p>Then i had a look at the request header and it has the authorization header under Access-Control-Request-Headers as below. But it is not visible to the server side.</p>
  
  <p><a href="https://i.stack.imgur.com/YKZg8.png" rel="noreferrer"><img src="https://i.stack.imgur.com/YKZg8.png" alt="enter image description here"></a></p>
  
  <p>Then i read further and found that this could be an issue with CORS configuration. So i have modified my CORS configuration filter to have addExposedHeader as below</p>
  
  <pre><code>@Bean
  public CorsFilter corsFilter() {
      UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
      CorsConfiguration config = new CorsConfiguration();
      config.setAllowCredentials(true);
      config.addAllowedOrigin("*");
      config.addAllowedHeader("*");
      config.addExposedHeader("authorization");
      config.addAllowedMethod("OPTIONS");
      config.addAllowedMethod("GET");
      config.addAllowedMethod("POST");
      config.addAllowedMethod("PUT");
      config.addAllowedMethod("DELETE");
  
      //config.addExposedHeader("Content-Type");
      source.registerCorsConfiguration("/**", config);
      return new CorsFilter(source);
  }
  </code></pre>
  
  <p>Still the server complains that it can not find the Authorization header. Did i miss any thing here? Appreciate your help</p>
  
  <p>Solution</p>
  
  <p>After reading the sideshowbarker's comment below, i was able to understand the basics behind the issue.
  In My Project I have a JWT token filter and inside that it always checks the Authorization header. Then i have modified it as below and now it works as expected</p>
  
  <pre><code>protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
  try {
  
      if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
          response.setStatus(HttpServletResponse.SC_OK);
      }else{
          String authToken = request.getHeader(this.tokenHeader);
          jWTTokenAuthenticationService.parseClaimsFromToken(authToken);
          --
      }
      chain.doFilter(request, response);
  }Catch(AuthenticationException authEx){
      SecurityContextHolder.clearContext();
      if (entryPoint != null) {
          entryPoint.commence(request, response, authEx);
      }
  }
  </code></pre>
  
  <p>}</p>