title: Sending Authorization Token Bearer through Javascript
body: <p>I'm trying to send a Authorization Token Bearer through Javascript to a REST Endpoint, so i doing in this way:</p>
  
  <pre><code>$.ajax( {
      url: 'http://localhost:8080/resourceserver/protected-no-scope',
      type: 'GET',
      beforeSend : function( xhr ) {
          xhr.setRequestHeader( "Authorization", "Bearer " + token );
      },
      success: function( response ) {
          console.log(response);
      }
  </code></pre>
  
  <p>My endpoint is running under a SpringBoot container, so i'm getting the HttpServletRequest and trying to get AUthorization Header but is always null:</p>
  
  <pre><code>static Authentication getAuthentication(HttpServletRequest request) {
          String token = request.getHeader(HEADER_STRING);
          //token is always null
  ...
  </code></pre>
  
  <p><strong>Edit 1</strong>
  This is the error in Client-Side (Browser</p>
  
  <pre><code>OPTIONS http://localhost:8080/resourceserver/protected-no-scope 403 ()
  Failed to load http://localhost:8080/resourceserver/protected-no-scope: Response for preflight has invalid HTTP status code 403.
  </code></pre>
  
  <p><strong>Edit 2</strong>
  To enable CORS in backend i'm using the following annotation with spring:</p>
  
  <pre><code>@RestController
  @CrossOrigin(origins = "*", maxAge = 3600, allowCredentials = "true", allowedHeaders = "Authorization", methods =
          {RequestMethod.GET, RequestMethod.OPTIONS, RequestMethod.POST})
  public class MyResource {
  </code></pre>
  
  <p><strong>Edit 3</strong>
  I tried added the CORS in my Filter but no success:</p>
  
  <pre><code>public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
              throws IOException, ServletException {
  
          HttpServletRequest httpServletRequest = (HttpServletRequest) request;
          HttpServletResponse httpServletResponse = (HttpServletResponse) response;
  
          httpServletResponse.setHeader("Access-Control-Allow-Origin", httpServletRequest.getHeader("Origin"));
          httpServletResponse.setHeader("Access-Control-Allow-Credentials", "true");
          httpServletResponse.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE");
          httpServletResponse.setHeader("Access-Control-Max-Age", "3600");
          httpServletResponse.setHeader("Access-Control-Allow-Headers", "Content-Type, Accept, X-Requested-With, remember-me");
  
  
          Authentication authentication = TokenAuthenticationService
                  .getAuthentication(httpServletRequest);
  
          SecurityContextHolder.getContext().setAuthentication(authentication);
          filterChain.doFilter(request, response);
      }
  </code></pre>