title: Angular JS - Rest API - Authorization sent from browser but not received in server
body: <p>I have a spring boot application with basic spring security enabled.  And I have a web application written in Angular JS</p>
  
  <p>When I make a rest call, I can clearly see the Authorization header being passed. But in the server, it displays the header as Null.</p>
  
  <p><strong>P.S</strong> This happens only in my machine ( yeh the same old story ) but appears to be working everywhere else.</p>
  
  <p><strong>Request Header</strong></p>
  
  <pre><code>Accept: application/json, text/plain, */*
  Authorization: Basic YWRtaW5Ac211LmVkdS5zZzpleUXXXXXXXXXXXSmhaRzFwYmtCemJYVXVaV1IxTG5ObkXXXXXXXXXXXXTmpReGZRLnXXXXXXOExJNF80MjBjMTZMUTFWX2JLR1p1VjM5SmZ3dllXbkxVTmc4LWhEeGJhdXhlMjljc3l5dWVka0w=
  Content-Type: application/json
  Origin: http://localhost:9000
  Referer: http://localhost:9000/
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36
  </code></pre>
  
  <p><strong>Response Header</strong></p>
  
  <pre><code>Access-Control-Allow-Origin: *
  Access-Control-Expose-Headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
  Connection: Keep-Alive
  Content-Length: 68
  Content-Type: application/json;charset=UTF-8
  Date: Fri, 22 Mar 2019 05:38:23 GMT
  Server: NA
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  X-XSS-Protection: 1; mode=block
  </code></pre>
  
  <p><strong>Server Copmonent</strong>
  The server component is built using camel and maven restlet.</p>
  
  <pre><code>from(reslet://routeName)
  .log("${in.headers}"; // the auth header is completely ignored.
  </code></pre>
  
  <p>The app is deployed in tomcat and the web.xml has filters as below</p>
  
  <pre><code>&lt;filter&gt;
    &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
    &lt;filter-class&gt;org.apache.catalina.filters.CorsFilter&lt;/filter-class&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;cors.allowed.origins&lt;/param-name&gt;
        &lt;param-value&gt;*&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;cors.allowed.methods&lt;/param-name&gt;
        &lt;param-value&gt;GET,POST,PUT,DELETE&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;cors.allowed.headers&lt;/param-name&gt;
        &lt;param-value&gt;Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization, Cache-Control&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;cors.exposed.headers&lt;/param-name&gt;
        &lt;param-value&gt;Access-Control-Allow-Origin,Access-Control-Allow-Credentials&lt;/param-value&gt;
      &lt;/init-param&gt;
  
    &lt;init-param&gt;
      &lt;param-name&gt;cors.preflight.maxage&lt;/param-name&gt;
      &lt;param-value&gt;10&lt;/param-value&gt;
    &lt;/init-param&gt;
  &lt;/filter&gt;
  &lt;filter&gt;
          &lt;filter-name&gt;httpHeaderSecurity&lt;/filter-name&gt;
          &lt;filter-class&gt;org.apache.catalina.filters.HttpHeaderSecurityFilter&lt;/filter-class&gt;
          &lt;async-supported&gt;true&lt;/async-supported&gt;
   &lt;/filter&gt;
   &lt;filter&gt;
          &lt;filter-name&gt;envHttpHeaders&lt;/filter-name&gt;
          &lt;filter-class&gt;org.apache.catalina.filters.HttpHeaderSecurityFilter&lt;/filter-class&gt;
          &lt;async-supported&gt;true&lt;/async-supported&gt;
   &lt;/filter&gt;
  
   &lt;filter-mapping&gt; 
      &lt;filter-name&gt;envHttpHeaders&lt;/filter-name&gt; 
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  &lt;filter-mapping&gt; 
      &lt;filter-name&gt;httpHeaderSecurity&lt;/filter-name&gt; 
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  &lt;filter-mapping&gt;
    &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
    &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p><strong>Am also behind a Corporate proxy. Does it rip off Auth header</strong></p>