title: Spring OAuth2 Access Token in HTTP Header
body: <p>I am attempting to implement a Spring Oauth2 setup with the Authorization Server in an application on its own and Resource Servers in separate applications. </p>
  
  <p>I will say from the outset, that due to current system restrictions, I am forced to use older versions of Spring / Spring Security until such a time that we can plan in a system upgrade:</p>
  
  <ul>
  <li>Spring: 3.1.1 Spring </li>
  <li>Security: 3.2.7 </li>
  <li>Spring OAuth: 1.0.5</li>
  </ul>
  
  <p>I have everything working, however, when I request a restricted resource from the resouce server, I have to provide the access_token as a query paramater. </p>
  
  <p>I would prefer to provide this as an HTTP header. Is there built in functionality to do this within Spring Security Oauth?</p>
  
  <p>Resource Server Config</p>
  
  <pre><code>&lt;beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns:context="http://www.springframework.org/schema/context"
      xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
      xmlns:sec="http://www.springframework.org/schema/security"
      xsi:schemaLocation="http://www.springframework.org/schema/beans
  
      http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
      http://www.springframework.org/schema/security
      http://www.springframework.org/schema/security/spring-security-3.2.xsd
      http://www.springframework.org/schema/security/oauth2
      http://www.springframework.org/schema/security/spring-security-oauth2-1.0.xsd
      http://www.springframework.org/schema/context
      http://www.springframework.org/schema/context/spring-context-3.1.xsd"&gt;
  
      &lt;!-- Resource Server Filter --&gt;
      &lt;oauth:resource-server id="resourceServerFilter" resource-id="someResourceId" token-services-ref="tokenServices"/&gt;
      &lt;!-- END Resource Server Filter --&gt;
  
      &lt;!-- Protected resources --&gt;
      &lt;http pattern="/rest/BasicService/**" create-session="stateless" xmlns="http://www.springframework.org/schema/security" entry-point-ref="oauthAuthenticationEntryPoint"&gt;  
          &lt;anonymous enabled="false"/&gt;
          &lt;intercept-url pattern="/rest/BasicService/**" access="ROLE_USER"/&gt;
          &lt;custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER"/&gt;
          &lt;access-denied-handler ref="oauthAccessDeniedHandler"/&gt; 
      &lt;/http&gt;   
      &lt;!-- END Protected resources --&gt;
  
      &lt;!-- Authentication --&gt;
      &lt;sec:authentication-manager xmlns="http://www.springframework.org/schema/security" /&gt; 
      &lt;bean id="oauthAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint" xmlns="http://www.springframework.org/schema/beans"/&gt;
      &lt;bean id="oauthAccessDeniedHandler" class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler"/&gt;
      &lt;!-- END Authentication --&gt;         
  
      &lt;!-- Token Store --&gt;    
      &lt;bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.JdbcTokenStore"&gt;
          &lt;constructor-arg ref="myJdbcTokenStore" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="myJdbcTokenStore" class="org.springframework.jndi.JndiObjectFactoryBean"&gt;
          &lt;property name="jndiName" value="java:comp/env/jdbc/someJNDIDatabaseName"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"&gt;
          &lt;property name="tokenStore" ref="tokenStore"/&gt;
      &lt;/bean&gt;
      &lt;!-- END Token Store --&gt;
  
  &lt;/beans&gt;
  </code></pre>