Authorization header not excluded sometimes

Hi, Thanks for creating this excellent module. I’m new to Angular so apologies if this is not an issue and just me being an idiot.

I’m having a problem excluding the Authorization header in my requests. (preflight fails when Authorization header is included so I need it removed).

I’ve modified the given keycloak-heroes example to replicate my problem. I’ve added a span with on click event in the home component which calls HeroesService which makes a POST request to the URL I want excluded. I’ve also updated app-init.js with my url/realm/clientId and added the URL I want excluded.

Problem is the Authorization header is being included sometimes. First time I click the element - no Authorization header - second time Authorization header - third time no header etc…

I tried latest v1.2.3 and also tried various regex with the excluded URL but no luck.

If I remove keycloak from the providers in app.modules.ts the code works fine - as a test just in case it’s my lack of Angular causing the issue.

Here’s the changes I made so you can see what I’m talking about.

home.component.html:

I just added a span before the final div:

<span (click)="test()">TEST</span>

home.component.ts:

  test() {
    this.heroesService.graphQl('some query').subscribe((r) => { console.log(r); });
  }

heroes.service.ts:

  graphQl(query): any {
    const headers = new HttpHeaders({
      'X-COMPANY-API-Key' : 'xxx',
      'Content-Type' : 'application/json'
    });
    const options = { headers: headers };
    return this.http.post('https://api.COMPANY.com/graphql', query, options);
  }

app-init.ts:

  config: {
    url: 'https://login.COMPANY.com/auth/',
    realm: 'COMPANY-REALM',
    clientId: 'COMPANY-CLIENTID'
  },
  initOptions: {
    onLoad: 'login-required',
    checkLoginIframe: false
  },
  bearerExcludedUrls: [
    'https://api.COMPANY.com/graphql'
  ]

[angular101]

@mauriciovigolo Brilliant I look forward to the new release! Thanks for all your hard work.

[angular101]

Hi @mauriciovigolo,

Thanks for rapid response very much appreciated.

I tried using 'graphql' and I still get same problem - it includes the auth header every second time.

if I use '.*' it works and never includes the auth header.

I wonder if this has any bearing?: https://stackoverflow.com/questions/3811890/javascript-regular-expression-fails-every-other-time-it-is-called