title: CakePHP 3 + JWT + Xampp: Unable to read HTTP Authorization Bearer Token
body: <p>I'm designing this CakePHP 3 application using ADmad's <a href="https://github.com/ADmad/cakephp-jwt-auth" rel="nofollow noreferrer">CakePHP JWT Auth plugin</a> and <a href="http://www.bravo-kernel.com/2015/04/how-to-add-jwt-authentication-to-a-cakephp-3-rest-api/" rel="nofollow noreferrer">Bravo Kernel's tutorial</a>.</p>
  
  <p>I've followed the example and am able to generate the tokens by calling the token() method.</p>
  
  <p>However, when I post requests back using the token in form of Authorization Bearer xxx included in the headers, CakePHP is not able to read it.</p>
  
  <p>If I log the $request var, I see...</p>
  
  <pre><code>[_environment:protected] =&gt; Array
      (
          [REDIRECT_REDIRECT_HTTP_AUTHORIZATION] =&gt; Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJkZTUyYTIxZC02Nzk1LTRlZTgtYjFhYi1mYmY1N2M4OTQxNDAiLCJleHAiOjE1MTAzMDQxNTZ9.GeO-UACG491JsACeWqXYGasISBTRc7g74wVQjde-gYY
          [REDIRECT_REDIRECT_MIBDIRS] =&gt; D:/xampp7/php/extras/mibs
          [REDIRECT_REDIRECT_MYSQL_HOME] =&gt; \xampp\mysql\bin
          [REDIRECT_REDIRECT_OPENSSL_CONF] =&gt; D:/xampp7/apache/bin/openssl.cnf
          [REDIRECT_REDIRECT_PHP_PEAR_SYSCONF_DIR] =&gt; \xampp\php
  </code></pre>
  
  <p>...<br>
  ...</p>
  
  <pre><code>    [REQUEST_URI] =&gt; /api/requesters/load-user-details.json
      [SCRIPT_NAME] =&gt; /api/webroot/index.php
      [PHP_SELF] =&gt; /api/webroot/index.php
      [REQUEST_TIME_FLOAT] =&gt; 1509704194.57
      [REQUEST_TIME] =&gt; 1509704194
      [HTTP_AUTHORIZATION] =&gt; Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJkZTUyYTIxZC02Nzk1LTRlZTgtYjFhYi1mYmY1N2M4OTQxNDAiLCJleHAiOjE1MTAzMDQxNTZ9.GeO-UACG491JsACeWqXYGasISBTRc7g74wVQjde-gYY
      [ORIGINAL_REQUEST_METHOD] =&gt; GET
      [HTTP_X_REQUESTED_WITH] =&gt; 
  </code></pre>
  
  <p>As per Bravo Kernel's tutorial / ADmad's explanation, I've added the following lines in .htaccess to ensure Apache passes on the token.. </p>
  
  <pre><code>RewriteEngine On
  RewriteCond %{HTTP:Authorization} ^(.*)
  RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]
  </code></pre>
  
  <p>The token appears to be included in the headers .. but the plugin still keeps outputting ..</p>
  
  <pre><code>{
      "message": "You are not authorized to access that location.",
      "url": "/requesters/load-user-details.json",
      "code": 401,
  }
  </code></pre>
  
  <p>Any clues on what to do next?</p>
  
  <p>Thank you. </p>