title: Can't get Lexik JWT token from other domain
body: <p>Symfony 4</p>
  <p>I made a lexik jwt autorization by instruction:</p>
  <p><a href="https://h-benkachoud.medium.com/symfony-rest-api-without-fosrestbundle-using-jwt-authentication-part-2-be394d0924dd" rel="nofollow noreferrer">https://h-benkachoud.medium.com/symfony-rest-api-without-fosrestbundle-using-jwt-authentication-part-2-be394d0924dd</a></p>
  <p>It works fine from postman or console curl.
  When I try to get token by ajax request (from other domain) I have standart error</p>
  <blockquote>
  <p>No 'Access-Control-Allow-Origin' header is present on the requested
  resource.</p>
  </blockquote>
  <p>I try to fix it by nelmio_cors bundle</p>
  <p>BUT</p>
  <p><strong>If I take token by postman or console curl - debugger even doesn't enter to the controller, and I get token (I even don't know how).</strong></p>
  <p><strong>If I try to take token by ajax request (from other domain) AFTER installing nelmio - I get into the controller: App\Controller\AuthController::getTokenUser</strong></p>
  <p>And I have an 500 error</p>
  <blockquote>
  <p>Cannot autowire argument $user of
  &quot;App\Controller\AuthController::getTokenUser()&quot;: it references
  interface &quot;Symfony\Component\Security\Core\User\UserInterface&quot; but no
  such service exists. Did you create a class that implements this
  interface?</p>
  </blockquote>
  <p>I dont understand why with nelmio_cors request from other domain gets to the controller, and doesn't get without nelmio_cors...
  How to fix it?</p>
  <p>I need to have token by http request from other domain</p>
  <p>security.yaml</p>
  <pre><code>    # https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
      encoders:
          App\Entity\User:
              algorithm: bcrypt
  
  
      providers:
          app_user_provider:
              entity:
                  class: App\Entity\User
                  property: username
  
      firewalls:
  
          login:
              pattern:  ^/api/login
              stateless: true
              anonymous: true
              json_login:
                  provider: app_user_provider
                  check_path:               /api/login_check
                  success_handler:          lexik_jwt_authentication.handler.authentication_success
                  failure_handler:          lexik_jwt_authentication.handler.authentication_failure
          dev:
              pattern: ^/(_(profiler|wdt)|css|images|js)/
              security: false
          main:
              anonymous: true
  
      # Easy way to control access for large sections of your site
      # Note: Only the *first* access control that matches will be used
      access_control:
          - { path: ^/register, roles: IS_AUTHENTICATED_ANONYMOUSLY }
          - { path: ^/api/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
          - { path: ^/api/login_check, roles: IS_AUTHENTICATED_ANONYMOUSLY }
          - { path: ^/api/test,       roles: IS_AUTHENTICATED_FULLY }
  
  </code></pre>
  <p>router:</p>
  <pre><code>api_login_check:
    path: /api/login_check
    controller: App\Controller\AuthController::getTokenUser
  
  </code></pre>
  <p>AuthController:</p>
  <pre><code>&lt;?php
  
  namespace App\Controller;
  
  use Lexik\Bundle\JWTAuthenticationBundle\Services\JWTTokenManagerInterface;
  use Symfony\Component\HttpFoundation\JsonResponse;
  use Symfony\Component\Security\Core\User\UserInterface;
  
  class AuthController extends ApiController
  {
  
      /**
       * @param UserInterface $user
       * @param JWTTokenManagerInterface $JWTManager
       * @return JsonResponse
       */
      public function getTokenUser(UserInterface $user, JWTTokenManagerInterface $JWTManager)
      {
          return new JsonResponse(['token' =&gt; $JWTManager-&gt;create($user)]);
      }
  }
  </code></pre>
  <p>nelmio_cors.yaml:</p>
  <pre><code>nelmio_cors:
      defaults:
          origin_regex: true
          allow_origin: ['%env(CORS_ALLOW_ORIGIN)%']
          allow_methods: ['GET', 'OPTIONS', 'POST', 'PUT', 'PATCH', 'DELETE']
          allow_headers: ['Content-Type', 'Authorization']
          expose_headers: ['Link']
          max_age: 3600
      paths:
          '^/': null
  
  </code></pre>
  <p>CORS_ALLOW_ORIGIN='^.*$'</p>
  <p>.htaccess:</p>
  <pre><code>RewriteEngine On
  Options +FollowSymlinks
  RewriteBase /
  
  RewriteCond %{HTTP:Authorization} ^(.*)
  RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]
  
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule ^.*$ index.php [L]
  </code></pre>
  <p>Help please</p>