title: Access not allowed for retrieving scripts
body: <p>I have a set of microservices that run behind a Netflix Zuul gateway, which implements OAUTH2 based security and issues a JWT to the browser after successful authentication.</p>
  
  <p>All of the normal Spring MVC pages display fine, but I have one app that uses Jersey and JSP pages, where the Zuul server blocks retrieval of any CSS and JS files with a 401 error.</p>
  
  <p>How would one go about to include the current user's JWT when browsing to the JSP page?</p>
  
  <pre><code>&lt;!DOCTYPE html&gt;
  
  &lt;%@ page contentType="text/html" language="java" pageEncoding="UTF-8" %&gt;
      &lt;%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%&gt;
  
          &lt;% 
      String selectionUri = (String) request.getAttribute("selectionUri");
      String removeUri = (String) request.getAttribute("removeUri");
  %&gt;
  
              &lt;html&gt;
  
              &lt;head&gt;
                  &lt;meta http-equiv="Content-Type" content="text/html;charset=utf-8"&gt;
                  &lt;meta name="_csrf" content="${_csrf.token}" /&gt;
                  &lt;meta name="_csrf_header" content="${_csrf.headerName}" /&gt;
                  &lt;title&gt;Smart Mine Treeview&lt;/title&gt;
                  &lt;link rel="stylesheet" href="&lt;c:url value='../../static/css/bootstrap-4.0.0-beta.min.css'/&gt;" /&gt;
                  &lt;link rel="stylesheet" href="&lt;c:url value='../../static/css/bootstrap-treeview.css'/&gt;" /&gt;
                  &lt;link rel="stylesheet" href="&lt;c:url value='../../static/css/mimacs.css'/&gt;" /&gt;
                  &lt;link rel="stylesheet" href="&lt;c:url value='../../static/css/all.css'/&gt;"&gt;
                  &lt;script src="&lt;c:url value='../../static/js/jquery-3.2.1.min.js'/&gt;"&gt;&lt;/script&gt;
                  &lt;script src="&lt;c:url value='../../static/js/bootstrap-4.0.0-beta.min.js'/&gt;"&gt;&lt;/script&gt;
                  &lt;script src="&lt;c:url value='../../static/js/bootstrap-treeview.js'/&gt;"&gt;&lt;/script&gt;
                  &lt;/head&gt;
  
              &lt;body onLoad='loadTreeview("&lt;%= selectionUri %&gt;")' style="background-color: transparent"&gt;
                  &lt;div id="myFrame" style="display: none;"&gt;
                      &lt;div class="my-frame"&gt;
                          &lt;div class="my-hdr my-title"&gt;Location Hierarchy&lt;/div&gt;
                          &lt;div id="treeview" class="treeview my-treeview"&gt;&lt;/div&gt;
                      &lt;/div&gt;
                  &lt;/div&gt;
              &lt;/body&gt;
  
              &lt;/html&gt;
  </code></pre>
  
  <p>Accessing the page directly displays fine, but not through a proxy.
  Requesting the resources with the links in the browser work. <a href="http://localhost:30111/my-app/static/js/jquery-3.2.1.min.js" rel="nofollow noreferrer">http://localhost:30111/my-app/static/js/jquery-3.2.1.min.js</a>, for example, can be retrieved successfully through the gateway hosted on port 30111.</p>
  
  <p>Hence I'm assuming it is something to do whith the JSP pages not submitting the current user's credentials along with the request for the resources.</p>
  
  <p>Any help on where to start looking?</p>