CORS filtering not working in 'Authorization' header : <p>I am trying to add OAuth 2.0 in spring mvc app. User should be authenticated in order to get a api call. I have set a headers in spring mvc controller as:</p>

<pre><code>@RequestMapping(value = "/admin-api/get-all-order", method = RequestMethod.GET)
    public ResponseEntity getAllOrders(@RequestHeader("Authorization") String bearerToken) {
        try {
            List&lt;OrderModel&gt; order = orderService.getAllOrders();
            return new ResponseEntity(order, HttpStatus.OK);
        } catch (HibernateException e) {
            return new ResponseEntity(e.getMessage(), HttpStatus.BAD_REQUEST);
        }
    }
</code></pre>

<p>For requesting api I have used angular 5. I make a api call in angular like:</p>

<pre><code>return this.http.get&lt;T&gt;(this.getAllOrderUrl, {
            headers: {
                "Authorization": "bearer " + JSON.parse(localStorage.getItem("token"))["value"],
                "Content-type": "application/json"
            }
        }).catch(error =&gt; {
            return this.auth.handleError(error);
        })
</code></pre>

<p><a href="https://i.stack.imgur.com/i2tS8.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/i2tS8.png" alt="enter image description here"></a></p>

<p>I have already enabled a CORS for 'localhost:4200'. CORS filtering works fine on other request. </p>

<pre><code>@Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
            throws IOException, ServletException {
        HttpServletResponse response = (HttpServletResponse) res;
        HttpServletRequest request = (HttpServletRequest) req;
        response.setHeader("Access-Control-Allow-Origin", "*");
        response.setHeader("Access-Control-Allow-Credentials", "true");
        response.setHeader("Access-Control-Allow-Methods",
                "ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL");
        response.setHeader("Access-Control-Max-Age", "3600");
        response.setHeader("Access-Control-Allow-Headers",
                "X-PINGOTHER,Content-Type,X-Requested-With,Accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,Key");

        if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
            response.setStatus(HttpServletResponse.SC_OK);
        } else {
            chain.doFilter(req, res);
        }
    }
</code></pre>

<p>If I tried in postman it give me a desired result
<a href="https://i.stack.imgur.com/eCyTQ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/eCyTQ.png" alt="enter image description here"></a></p>

<p>**Response Header **
<a href="https://i.stack.imgur.com/XV9w2.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/XV9w2.png" alt="enter image description here"></a>
What am I doing wrong? Please help me out. Hoping for positive response thanks!</p>
