{"action":"created","issue":{"url":"https://api.github.com/repos/swagger-api/swagger-ui/issues/686","repository_url":"https://api.github.com/repos/swagger-api/swagger-ui","labels_url":"https://api.github.com/repos/swagger-api/swagger-ui/issues/686/labels{/name}","comments_url":"https://api.github.com/repos/swagger-api/swagger-ui/issues/686/comments","events_url":"https://api.github.com/repos/swagger-api/swagger-ui/issues/686/events","html_url":"https://github.com/swagger-api/swagger-ui/issues/686","id":46768332,"node_id":"MDU6SXNzdWU0Njc2ODMzMg==","number":686,"title":"Request header field Authorization is not allowed by Access-Control-Allow-Headers","user":{"login":"tschaffter","id":3056480,"node_id":"MDQ6VXNlcjMwNTY0ODA=","avatar_url":"https://avatars0.githubusercontent.com/u/3056480?v=4","gravatar_id":"","url":"https://api.github.com/users/tschaffter","html_url":"https://github.com/tschaffter","followers_url":"https://api.github.com/users/tschaffter/followers","following_url":"https://api.github.com/users/tschaffter/following{/other_user}","gists_url":"https://api.github.com/users/tschaffter/gists{/gist_id}","starred_url":"https://api.github.com/users/tschaffter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tschaffter/subscriptions","organizations_url":"https://api.github.com/users/tschaffter/orgs","repos_url":"https://api.github.com/users/tschaffter/repos","events_url":"https://api.github.com/users/tschaffter/events{/privacy}","received_events_url":"https://api.github.com/users/tschaffter/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2014-10-24T18:24:02Z","updated_at":"2018-07-01T15:16:58Z","closed_at":"2014-10-28T09:47:51Z","author_association":"NONE","body":"Hello,\n\nMy issue is related to the sending of the authorization header, which seems to be an issue which has been reported several times. However, none of the answers solved my issue, maybe because Swagger UI has evolved since.\n\nShort description:\n\nI have a Java REST API and a GET method which requires oauth2 authentication. Swagger got an access token from the API and the permission \"On/Off button\" is set to \"On\". I click on \"Try it out!\" to execute the request and get the following error in the console.\n\nXMLHttpRequest cannot load http://localhost:8080/rest-oauth2/v1.0/events/1. Request header field Authorization is not allowed by Access-Control-Allow-Headers.\n\nWhat is working?\n\nI can successfully execute the following curl request from localhost:\n\n```\n$ curl -v -X GET -H \"Content-Type: application/json\" -H \"Authorization: Bearer <access_token>\" 'http://localhost:8080/rest-oauth2/v1.0/events/544777392dbf3cc5a3393bf7'\n```\n\nSwagger UI is available from an Apache server hosted on localhost. Methods documented correctly appear in Swagger UI. The above GET method is annotated with @ApiOperation (see below). Consequently, an On/Off button appears in Swagger UI for this method. When the user click on it, he is redirected to a login page I created. Its credentials are sent to the authentication provider which returns an access token. This token is sent to Swagger UI's page o2c.html, which in turns lead to the execution of the following instruction in swagger-oauth.js:\n\n```\nwindow.authorizations.add(\"oauth2\", new ApiKeyAuthorization(\"Authorization\", \"Bearer \" + b, \"header\"));\n```\n\nSo far everything is fine and Swagger UI now has the access token required to get access to protected data. Now I click on \"Try it out!\" from a browser on locahost and get \"Request header field Authorization is not allowed by Access-Control-Allow-Headers.\" in the browser console.\n\nOutput shown in Swagger UI:\n\n```\nRequest URL: http://localhost:8080/rest-oauth2/v1.0/events/1\nResponse Body: no content\nResponse Code: 0\nResponse Headers: {}\n```\n\nThe curl command works and the authentication header is accepted. Why not the authentication header from Swagger (is it effectively sent)?\n\n```\nRequest Headers  (view source)\nAccept:*/*\nAccept-Encoding:gzip,deflate,sdch\nAccept-Language:en-US,en;q=0.8\nAccess-Control-Request-Headers:accept, authorization, content-type\nAccess-Control-Request-Method:GET\nCache-Control:no-cache\nConnection:keep-alive\nDNT:1\nHost:localhost:8080\nOrigin:http://localhost\nPragma:no-cache\nReferer:http://localhost/swagger/\nUser-Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36\n```\n\n```\nResponse Headers (view source)\nAccess-Control-Allow-Headers:X-HTTP-Method-Override, Content-Type, x-requested-with\nAccess-Control-Allow-Methods:GET, POST, PUT, DELETE\nAccess-Control-Allow-Origin:http://localhost\n```\n\nMore information about my setup (please feel free to request more if required):\n\nGradle.build file:\ncompile \"com.wordnik:swagger-jersey2-jaxrs_2.11:1.3.10\"\n\nAnnotation of the GET method (Java REST API):\n\n``` java\n    @ApiOperation(value = \"Get event\", response = ApiEvent.class,\n        authorizations = { @Authorization(value = \"oauth2\",\n            scopes = {\n                @AuthorizationScope(scope = \"read:events\", description = \"Read your events\")\n        })\n    })\n```\n\nSwagger configuration:\n\n``` java\n        ConfigFactory.config().setApiVersion(\"1.0\");\n        ConfigFactory.config().setBasePath(\"http://localhost:8080/rest-oauth2\");\n\n        ApiInfo info = new ApiInfo(\n                \"REST Application\",                             /* title */\n                \"HTML description\",\n                \"http://helloreverb.com/terms/\",                  /* TOS URL */\n                \"apiteam@wordnik.com\",                            /* Contact */\n                \"Apache 2.0\",                                     /* license */\n                \"http://www.apache.org/licenses/LICENSE-2.0.html\" /* license URL */\n        );\n\n        List<AuthorizationScope> scopes = new ArrayList<AuthorizationScope>();\n        scopes.add(new AuthorizationScope(\"read:events\", \"Read your events (config)\"));\n\n        List<GrantType> grantTypes = new ArrayList<GrantType>();\n\n        ImplicitGrant implicitGrant = new ImplicitGrant(\n                new LoginEndpoint(\"http://localhost:8080/rest-oauth2/swagger_login.html\"),\n                \"access_token\");\n\n        grantTypes.add(implicitGrant);\n\n        AuthorizationType oauth = new OAuthBuilder().scopes(scopes).grantTypes(grantTypes).build();\n\n        ConfigFactory.config().addAuthorization(oauth);\n        ConfigFactory.config().setApiInfo(info);\n```\n\nSwagger UI index.html:\n\n``` js\n            initOAuth({\n              clientId: \"353b302c44574f565045687e534e7d6a\", // test clients\n              realm: \"test\", // defined in spring/oauth/oauth2-configuration.xml\n              appName: \"your-app-name\"\n            });\n```\n\nThank you for your help\n"},"comment":{"url":"https://api.github.com/repos/swagger-api/swagger-ui/issues/comments/401613157","html_url":"https://github.com/swagger-api/swagger-ui/issues/686#issuecomment-401613157","issue_url":"https://api.github.com/repos/swagger-api/swagger-ui/issues/686","id":401613157,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMTYxMzE1Nw==","user":{"login":"HenriquePereiraRosa","id":16025104,"node_id":"MDQ6VXNlcjE2MDI1MTA0","avatar_url":"https://avatars2.githubusercontent.com/u/16025104?v=4","gravatar_id":"","url":"https://api.github.com/users/HenriquePereiraRosa","html_url":"https://github.com/HenriquePereiraRosa","followers_url":"https://api.github.com/users/HenriquePereiraRosa/followers","following_url":"https://api.github.com/users/HenriquePereiraRosa/following{/other_user}","gists_url":"https://api.github.com/users/HenriquePereiraRosa/gists{/gist_id}","starred_url":"https://api.github.com/users/HenriquePereiraRosa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HenriquePereiraRosa/subscriptions","organizations_url":"https://api.github.com/users/HenriquePereiraRosa/orgs","repos_url":"https://api.github.com/users/HenriquePereiraRosa/repos","events_url":"https://api.github.com/users/HenriquePereiraRosa/events{/privacy}","received_events_url":"https://api.github.com/users/HenriquePereiraRosa/received_events","type":"User","site_admin":false},"created_at":"2018-07-01T15:16:58Z","updated_at":"2018-07-01T15:16:58Z","author_association":"NONE","body":"@fehguy  Please, could you post the  code? The repo that you had citted has been changed.\r\n\r\nI'm having the same problem with my SpringBoot server app. I've added the \"authorization\" header in my CorsFilter.java but the problem continues."}}
{"actor":{"display_login":"HenriquePereiraRosa"}}