# \[Solved\] Authorization header isn't being sent on POST **URL:** \ **Category:** Kibana\ **Created:** [April 18, 2017, 9:55pm UTC](https://discuss.elastic.co/t/solved-authorization-header-isnt-being-sent-on-post/82785 "2017-04-18T21:55:16Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Kikketer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kikketer/32/13813_2.png) [@Kikketer](https://discuss.elastic.co/u/Kikketer)\ **Post date:** [April 18, 2017, 9:55pm UTC](https://discuss.elastic.co/t/solved-authorization-header-isnt-being-sent-on-post/82785/1 "2017-04-18T21:55:16Z")
I have a custom app that sends a POST to get some data. I noticed however in my local development (without xpack installed) the Authorization header isn't sent. Here's a bit of code that works (from another plugin but follows the same flow): ```auto return this.http.get(chrome.addBasePath('/api/watcher/watchers')).then(.... ``` Will send the Authorization header: `Authorization:Basic Z...` However this plugin does a POST: ```auto return this._http.post(chrome.addBasePath('/api/app/apps'), {indices: indices}).then(... ``` This one does not send a Authorization header and I get an error: ```auto [security_exception] missing authentication token for REST request [... ``` * * * Both are being sent before the page loads via the `resolve` action in the angular route. Is there something that I need to specifically set for POSTs to send the Auth header? Are there any known issues where the Auth header will not be sent or is ripped out by accident? Does anyone know where this Auth header is stored between requests? ---
**Author:** ![whoami](https://avatars.discourse-cdn.com/v4/letter/w/a9a28c/32.png) [@whoami](https://discuss.elastic.co/u/whoami)\ **Post date:** [April 19, 2017, 12:06pm UTC](https://discuss.elastic.co/t/solved-authorization-header-isnt-being-sent-on-post/82785/2 "2017-04-19T12:06:35Z")
have you add request header whitelist ? ---
**Author:** ![Kikketer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kikketer/32/13813_2.png) [@Kikketer](https://discuss.elastic.co/u/Kikketer)\ **Post date:** [April 19, 2017, 1:32pm UTC](https://discuss.elastic.co/t/solved-authorization-header-isnt-being-sent-on-post/82785/3 "2017-04-19T13:32:26Z")
I didn't have to in the past, not sure how to even do that. Both of the projects simply have the standard routing backend for any plugin. Where would this whitelist live? ---
**Author:** ![Kikketer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kikketer/32/13813_2.png) [@Kikketer](https://discuss.elastic.co/u/Kikketer)\ **Post date:** [April 21, 2017, 2:01am UTC](https://discuss.elastic.co/t/solved-authorization-header-isnt-being-sent-on-post/82785/4 "2017-04-21T02:01:39Z")
Further frustration and trials. I've discovered that this one specific app refuses to send the authorization header. What's funny is that if I hijack a url of another plugin, it works! So for example, if my "apps" plugin suddenly changes it's endpoints from: ```auto /api/app_plugin/apps ``` to ```auto /api/watcher/apps ``` The "watcher" URL portion is from another plugin installed. The "apps" plugin responds to it since I set up the route and it gets the authorization header. But it only gets the authorization header IF I visit the "watcher" plugin first which hits `/api/watcher/watches`. If I uninstall the "watcher" plugin, the authorization header isn't set to any URL related to the "apps" plugin. This whole situation is baffling. Why is this custom plugin I've built called "watchers" work every single time with no issues. I have about 4 other plugins as well, none of them have issues. P.S. This issue doesn't exist at all in my actual environments because I'm using x-pack security and it seems the cookie is fine and happy with the whole situation. ---
**Author:** ![whoami](https://avatars.discourse-cdn.com/v4/letter/w/a9a28c/32.png) [@whoami](https://discuss.elastic.co/u/whoami)\ **Post date:** [April 24, 2017, 10:57am UTC](https://discuss.elastic.co/t/solved-authorization-header-isnt-being-sent-on-post/82785/5 "2017-04-24T10:57:23Z")
> [@Kikketer](#): > > This whole situation is baffling. Why is this custom plugin I've built called "watchers" work every single time with no issues. I have about 4 other plugins as well, none of them have issues. would you mind show me your plugin source? ---
**Author:** ![Kikketer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kikketer/32/13813_2.png) [@Kikketer](https://discuss.elastic.co/u/Kikketer)\ **Post date:** [April 24, 2017, 1:47pm UTC](https://discuss.elastic.co/t/solved-authorization-header-isnt-being-sent-on-post/82785/6 "2017-04-24T13:47:55Z")
It's troublesome with my company, they fear the release of code (regardless of how generic it is). For now I'm going to create a couple sample projects and hopefully recreate the issue in a stripped down version. It may either make the issue obvious and this help me fix it, or will be shareable. Thanks for your help @whoami ---
**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\ **Post date:** [April 24, 2017, 11:16pm UTC](https://discuss.elastic.co/t/solved-authorization-header-isnt-being-sent-on-post/82785/7 "2017-04-24T23:16:20Z")
@Kikketer the browser decides when to send the Authorization header, and only does so when it gets a 401 response from the backend with the same authentication realm name. See [http://stackoverflow.com/a/12701105/296172](http://stackoverflow.com/a/12701105/296172) In order for your plugin to get the same Authorization header that other plugins are getting, make sure to properly forward 401 responses and check out the way that Kibana does it here: [https://github.com/elastic/kibana/blob/master/src/core\_plugins/elasticsearch/lib/cluster.js#L91-L101](https://github.com/elastic/kibana/blob/master/src/core_plugins/elasticsearch/lib/cluster.js#L91-L101) ---
**Author:** ![Kikketer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kikketer/32/13813_2.png) [@Kikketer](https://discuss.elastic.co/u/Kikketer)\ **Post date:** [April 25, 2017, 2:34pm UTC](https://discuss.elastic.co/t/solved-authorization-header-isnt-being-sent-on-post/82785/8 "2017-04-25T14:34:11Z")
Thanks @spalger I'll look at that. Thing is my "watcher" plugin that's working correctly didn't do anything special to get the authorization working. Same goes for the "apps" plugin where authentication doesn't work. I'll be building out generics whenever I find the time to see if I can narrow down the differences. But both are relatively simple plugins. For now I really hacked the "apps" plugin to just work locally for me: ``` if (process.env.WTF && !request.headers.authorization) { request.headers.authorization = 'Basic ZW...' } ``` Like I said, in production it works fine because the cookies are golden and we are using x-pack. ---
**Author:** ![Kikketer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kikketer/32/13813_2.png) [@Kikketer](https://discuss.elastic.co/u/Kikketer)\ **Post date:** [May 17, 2017, 9:00pm UTC](https://discuss.elastic.co/t/solved-authorization-header-isnt-being-sent-on-post/82785/9 "2017-05-17T21:00:56Z")
@spalger This issue is starting to spread to another plugin of mine. Not sure why it wouldn't be sending the authentication headers by default since the endpoints are just inside the server side of Kibana. A `POST` call to: `https://localhost:5601/yzb/es_admin/_mget` has the authentication attached, but immedately afterward with my own endpoints: `https://localhost:5601/yzb/api/rawlog/search` does not. The server side is pretty simple: ```auto module.exports = function(server) { //Search server.route({ method: ['POST'], path: '/api/rawlog/search', handler: function(request, reply) { let searchIndex = request.payload.index search(server, request, searchIndex) .then(results => { reply(jsend.success(results)) }) .catch(err => { reply(jsend.error(err)) }) } }) ``` Other plugins seem to work just fine. I'm not sure actually how to send a 401 response via the server side plugin code. ---
**Author:** ![Kikketer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kikketer/32/13813_2.png) [@Kikketer](https://discuss.elastic.co/u/Kikketer)\ **Post date:** [May 17, 2017, 9:22pm UTC](https://discuss.elastic.co/t/solved-authorization-header-isnt-being-sent-on-post/82785/10 "2017-05-17T21:22:19Z")
I've been unable to narrow this down as well. I have a similar project that i've branched. One branch it'll send the auth headers, the other branch it will not. The EXACT same code is placed in both branches but the auth goes in one but not the other: Client (on initialize of the constructor): ```auto this.http.post(chrome.addBasePath('/api/rawlog/wtf')) ``` Server: ```auto server.route({ path: '/api/rawlog/wtf', method: ['POST'], handler(request, reply) { reply({ ok: true, resp: [] }) } }) ``` Similar to my original post, I assume the auth is working in the first branch because something else is initiating this authentication requirement. I'm not sure what it is however... ![](https://us1.discourse-cdn.com/elastic/original/3X/7/3/73463c5c83347e4059233878d9a077bfc202317e.png) Is there something in the server that I need to set? In the 8 plugins I've written so far I've never had to do anything special to get authentication to work, it just worked. Now 2 of them are starting to fail and only because I moved some code around (instead of being one big file). ---
**Author:** ![Kikketer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kikketer/32/13813_2.png) [@Kikketer](https://discuss.elastic.co/u/Kikketer)\ **Post date:** [May 18, 2017, 8:38pm UTC](https://discuss.elastic.co/t/solved-authorization-header-isnt-being-sent-on-post/82785/11 "2017-05-18T20:38:07Z")
I've created a generic plugin that gets the authorization header sent along fine. There's literally no extra configuration needed. I'm currently working through the "not-working" branch to see if I can get it to stop working now. I assume by doing this I'll discover the issue. > **[Kikketer/generic-auth-plugin](https://github.com/Kikketer/generic-auth-plugin/tree/working)** > > generic-auth-plugin - A test of the authentication of Kibana ---
**Author:** ![Kikketer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kikketer/32/13813_2.png) [@Kikketer](https://discuss.elastic.co/u/Kikketer)\ **Post date:** [May 18, 2017, 9:05pm UTC](https://discuss.elastic.co/t/solved-authorization-header-isnt-being-sent-on-post/82785/12 "2017-05-18T21:05:17Z")
I discovered the issue, narrowed down to one line. The catch error has to be sent in the raw instead of wrapped up in a jsend (or any other object) > If you compare working to non-working that's the only difference. In non-working the authorization headers are not sent. The "i need authorization headers" command is sent (invisible to chrome tools and such) as an error and the error object needs to be in tact to work properly. I witnessed this by adding a console log in the catch section and saw that it was thrown even when everything else was working. SOLVED! WOOT ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 15, 2017, 9:05pm UTC](https://discuss.elastic.co/t/solved-authorization-header-isnt-being-sent-on-post/82785/13 "2017-06-15T21:05:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.