Incorrect header in useHttpBasicAuthForPasswordFlow

Hello,

When configuring the basic authentication header for password flow you are using “Authentication” and the correct header for the scheme is “Authorization”

const header = btoa(`${this.clientId}:${this.dummyClientSecret}`);
                headers = headers.set(
                    'Authentication',
                    'BASIC ' + header);

[jeroenheijmans]

FYI: I just got a notification that this was changed in spring-security, slated for milestone “5.0.8”. That might make the workaround unneeded.

[vinliangx]

This is the workaround I’ve implemented for Spring Security:

The filter

import org.springframework.web.filter.OncePerRequestFilter;

@Component
public class BasicAuthHeaderFilter extends OncePerRequestFilter {
   @Override
   protected void doFilterInternal(HttpServletRequest request, 
                                                     HttpServletResponse response, 
                                                     FilterChain chain) throws ServletException, IOException {
      HttpServletRequestWrapper requestWrapper = new HttpServletRequestWrapper(request) {
                @Override
                public String getHeader(String name) {
                    String header = super.getHeader(name);                    
                    if (header == null && name.equalsIgnoreCase("authorization")){
                        header = super.getHeader("authentication");
                    }
                    if (header != null && header.toLowerCase().startsWith("basic")) {
                        return header.replaceAll("^[Bb][Aa][Ss][Ii][Cc]", "Basic");
                    }
                    return header;
                }
       };
      chain.doFilter(requestWrapper, response);
   }
}

Registering the Filter:

import org.springframework.boot.web.servlet.FilterRegistrationBean;

@Bean
public FilterRegistrationBean<BasicAuthHeaderFilter> filterFilterRegistrationBean(BasicAuthHeaderFilter filter) {
    FilterRegistrationBean<BasicAuthHeaderFilter> reg = new FilterRegistrationBean<>(filter);
    reg.setOrder(Ordered.HIGHEST_PRECEDENCE);
    return reg;
}

Thanks again @jeroenheijmans