title: Spring boot security x-auth-token not found in header
body: <p>I have a spring boot application having REST services secured with spring security. Redis is used for storing sessions. I have deployed the application in Glassfish 4.1.2. When trying to login using basic auth, <code>x-auth-token</code> is not returned in response header. What could be the issue ?</p>
  
  <p>Below are my configuration classes:</p>
  
  <p><strong>ApplicationSecurityConfig</strong></p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class ApplicationSecurityConfig extends WebSecurityConfigurerAdapter {
  
  @Autowired
  private CustomAuthenticationProvider customAuthenticationProvider;
  
  @Autowired
  private CustomAuthenticationDetailsSource source;
  
  @Autowired
  private HttpLogoutSuccessHandler logoutSuccessHandler;
  
  @Autowired
  private AuthenticationEntryPoint authenticationEntryPoint;  
  
  @Bean
  public HttpSessionStrategy httpSessionStrategy() {
      return new HeaderHttpSessionStrategy();
  }
  
  @Autowired
  public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
          auth.authenticationProvider(customAuthenticationProvider);
  }
  
  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http
              .authorizeRequests()
              .antMatchers("/crr/**").access("hasRole('CRR')")
              .anyRequest().authenticated()
              .and()
              .requestCache()
              .requestCache(new NullRequestCache())
              .and()
              .logout()
              .logoutUrl("/logout")
              .logoutSuccessHandler(logoutSuccessHandler)
              .and()
              .httpBasic().authenticationDetailsSource(source).authenticationEntryPoint(authenticationEntryPoint);
      http.exceptionHandling().authenticationEntryPoint(authenticationEntryPoint);
      http.csrf().disable();
    }   
  }
  </code></pre>
  
  <p><strong>CORSCustomFilter</strong></p>
  
  <pre><code>@Component
  @Order(Ordered.HIGHEST_PRECEDENCE) 
  public class CORSCustomFilter implements Filter {
  
  public void doFilter(ServletRequest servletRequest,
          ServletResponse servletResponse, FilterChain chain)
          throws IOException, ServletException {
  
      HttpServletResponse response = (HttpServletResponse) servletResponse;
      response.setHeader("Access-Control-Allow-Origin", "*");
      response.setHeader("Access-Control-Allow-Methods", "POST, GET");
      response.setHeader("Access-Control-Max-Age", "3600");
      response.setHeader("Access-Control-Allow-Headers",
              "X-Requested-With,content-type, Authorization");
      chain.doFilter(servletRequest, servletResponse);
  }
  
  public void init(FilterConfig filterConfig) {
  }
  
  public void destroy() {
   }
  }
  </code></pre>
  
  <p><strong>Note:</strong> When I deploy the application in Tomcat,<code>x-auth-token</code> is successfully generated in response header.</p>