{"action":"created","issue":{"url":"https://api.github.com/repos/expressjs/express/issues/3551","repository_url":"https://api.github.com/repos/expressjs/express","labels_url":"https://api.github.com/repos/expressjs/express/issues/3551/labels{/name}","comments_url":"https://api.github.com/repos/expressjs/express/issues/3551/comments","events_url":"https://api.github.com/repos/expressjs/express/issues/3551/events","html_url":"https://github.com/expressjs/express/issues/3551","id":293890860,"number":3551,"title":"How do I send authorization header with remote redirect?","user":{"login":"simonl65","id":14094202,"avatar_url":"https://avatars1.githubusercontent.com/u/14094202?v=4","gravatar_id":"","url":"https://api.github.com/users/simonl65","html_url":"https://github.com/simonl65","followers_url":"https://api.github.com/users/simonl65/followers","following_url":"https://api.github.com/users/simonl65/following{/other_user}","gists_url":"https://api.github.com/users/simonl65/gists{/gist_id}","starred_url":"https://api.github.com/users/simonl65/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/simonl65/subscriptions","organizations_url":"https://api.github.com/users/simonl65/orgs","repos_url":"https://api.github.com/users/simonl65/repos","events_url":"https://api.github.com/users/simonl65/events{/privacy}","received_events_url":"https://api.github.com/users/simonl65/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-02-02T13:38:01Z","updated_at":"2018-02-02T16:00:42Z","closed_at":"2018-02-02T16:00:42Z","author_association":"NONE","body":"Hi,\r\n\r\nI understand that automatically copying the authorization header to a remote redirection has a potential security issue, but is there a way to allow this for a whitelist? My requirement is to send a JWT when redirecting from my login server back to my application server. My current code is similar to this (on my login server):\r\n\r\n```javascript\r\nres.header( 'x-authorization', \"Bearer \" + JWT );\r\nres.redirect(307, 'http://appServer:5001/?key=value' );\r\n```\r\n\r\nCheers,\r\nSimon"},"comment":{"url":"https://api.github.com/repos/expressjs/express/issues/comments/362626441","html_url":"https://github.com/expressjs/express/issues/3551#issuecomment-362626441","issue_url":"https://api.github.com/repos/expressjs/express/issues/3551","id":362626441,"user":{"login":"simonl65","id":14094202,"avatar_url":"https://avatars1.githubusercontent.com/u/14094202?v=4","gravatar_id":"","url":"https://api.github.com/users/simonl65","html_url":"https://github.com/simonl65","followers_url":"https://api.github.com/users/simonl65/followers","following_url":"https://api.github.com/users/simonl65/following{/other_user}","gists_url":"https://api.github.com/users/simonl65/gists{/gist_id}","starred_url":"https://api.github.com/users/simonl65/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/simonl65/subscriptions","organizations_url":"https://api.github.com/users/simonl65/orgs","repos_url":"https://api.github.com/users/simonl65/repos","events_url":"https://api.github.com/users/simonl65/events{/privacy}","received_events_url":"https://api.github.com/users/simonl65/received_events","type":"User","site_admin":false},"created_at":"2018-02-02T16:00:42Z","updated_at":"2018-02-02T16:00:42Z","author_association":"NONE","body":"@LinusU Many thanks.\r\nWell I've learnt something! I wasn't aware that search params (#) won't be sent to the server - cool.\r\n\r\nAs all my app' servers will be in the same domain, I've already started coding with the JWT in a cookie.\r\n\r\nThanks for your help.\r\n\r\nCheers,\r\nSimon"}}
{"actor":{"display_login":"simonl65"}}