title: Spring Boot Security - Use token from Cookies if Authorization header missing
body: <p>I currently authenticate my requests against the JWK of my authorization server.
  I'm using the <code>spring-boot-starter-oauth2-resource-server</code> package on spring-boot 2.3.
  The JWT is taken out from the <code>Authorization: Bearer &lt;token&gt;</code> header and validated against the JWK endpoint.
  My security config looks like this:</p>
  
  <p>SecurityConfig.java</p>
  
  <pre class="lang-java prettyprint-override"><code>@EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
    @Autowired
    protected Environment env;
  
    @Override
    protected void configure(HttpSecurity http) throws Exception {
      http.csrf().disable();
      http.authorizeRequests().antMatchers("/logs").permitAll();
      http.authorizeRequests().antMatchers("/", "/api/**").authenticated();
      http.oauth2ResourceServer().jwt();
    }
  }
  </code></pre>
  
  <p>application.properties</p>
  
  <pre><code>spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://auth.work.com/v1/jwk
  </code></pre>
  
  <p>External users don't have the <code>Authorization: ...</code> header in their requests, but instead have the following 2 cookies that make up the JWT:</p>
  
  <pre><code>auth.token_type = Bearer
  auth.access_token = &lt;token&gt;
  </code></pre>
  
  <p>Is there a way to extract the JWT from the cookies and validate against the auth server if the the <code>Authorization: ...</code> header is missing?
  Could I extract the cookies and add a header to the request before it tries to authorize?
  Or it could even be a second method in the authentication chain.</p>