{"action":"created","issue":{"url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/566","labels_url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/566/labels{/name}","comments_url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/566/comments","events_url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/566/events","html_url":"https://github.com/lucadegasperi/oauth2-server-laravel/issues/566","id":110274115,"number":566,"title":"Authorization header does not reach server - no access token","user":{"login":"Twisterking","id":4247268,"avatar_url":"https://avatars.githubusercontent.com/u/4247268?v=3","gravatar_id":"","url":"https://api.github.com/users/Twisterking","html_url":"https://github.com/Twisterking","followers_url":"https://api.github.com/users/Twisterking/followers","following_url":"https://api.github.com/users/Twisterking/following{/other_user}","gists_url":"https://api.github.com/users/Twisterking/gists{/gist_id}","starred_url":"https://api.github.com/users/Twisterking/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Twisterking/subscriptions","organizations_url":"https://api.github.com/users/Twisterking/orgs","repos_url":"https://api.github.com/users/Twisterking/repos","events_url":"https://api.github.com/users/Twisterking/events{/privacy}","received_events_url":"https://api.github.com/users/Twisterking/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/labels/support","name":"support","color":"fad8c7"}],"state":"closed","locked":false,"assignee":{"login":"vinkla","id":499192,"avatar_url":"https://avatars.githubusercontent.com/u/499192?v=3","gravatar_id":"","url":"https://api.github.com/users/vinkla","html_url":"https://github.com/vinkla","followers_url":"https://api.github.com/users/vinkla/followers","following_url":"https://api.github.com/users/vinkla/following{/other_user}","gists_url":"https://api.github.com/users/vinkla/gists{/gist_id}","starred_url":"https://api.github.com/users/vinkla/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vinkla/subscriptions","organizations_url":"https://api.github.com/users/vinkla/orgs","repos_url":"https://api.github.com/users/vinkla/repos","events_url":"https://api.github.com/users/vinkla/events{/privacy}","received_events_url":"https://api.github.com/users/vinkla/received_events","type":"User","site_admin":false},"milestone":null,"comments":19,"created_at":"2015-10-07T17:16:15Z","updated_at":"2015-10-25T10:01:33Z","closed_at":"2015-10-08T07:34:25Z","body":"So I am using Lumen with the v5.0.2 of your lib.\r\nI already have received an access token and now want to GET some resource from the api:\r\n```php\r\n$app->group(['prefix' => 'api', 'middleware' => 'oauth'], function($app) {\r\n    $app->get('resource', function() {\r\n        return response()->json([\r\n            \"id\" => 1,\r\n            \"name\" => \"A resource\"\r\n        ]);\r\n    });\r\n});\r\n```\r\nI followed [this tutorial](http://esbenp.github.io/2015/05/26/lumen-web-api-oauth-2-authentication/) (with some adapdations) - so I am also using the jQOAuth plugin, which appends the `Authorization` header automatically to every get request. This works just fine (according to Chrome DevTools).\r\n\r\nProblem is that this header doesn't seem to reach the server. I get an exception saying\r\n```bash\r\n\"The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Check the \"access token\" parameter.\"\r\n```\r\nSo I searched for the function throwing this error: It should be `determineAccessToken` in `vendor/league/oauth2-server/src/ResourceServer.php`.\r\nI tried `Log::debug('HEADERS: ' . $this->getRequest()->headers);`which gives me this:\r\n```bash\r\nAccept:           */*\r\nAccept-Encoding:  gzip, deflate, sdch\r\nAccept-Language:  de-DE,de;q=0.8,en-US;q=0.6,en;q=0.4\r\nConnection:       keep-alive\r\nCookie:           refreshToken=eyJpdiI6Il....\r\nHost:             apitest.com\r\nReferer:          http://apitest.com/\r\nUser-Agent:       Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.52 Safari/537.36\r\nX-Csrf-Token:     null\r\nX-Requested-With: XMLHttpRequest\r\n```\r\nNo Authorization header. Thus no access token.\r\nI really don't understand what's wrong here. I know that the Authorization is somehow hidden but it has to show up here. Otherwise `if ($this->getRequest()->headers->get('Authorization') !== null)` could never work?!\r\n"},"comment":{"url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/comments/150908566","html_url":"https://github.com/lucadegasperi/oauth2-server-laravel/issues/566#issuecomment-150908566","issue_url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/566","id":150908566,"user":{"login":"DEATHMETALGORE","id":2448254,"avatar_url":"https://avatars.githubusercontent.com/u/2448254?v=3","gravatar_id":"","url":"https://api.github.com/users/DEATHMETALGORE","html_url":"https://github.com/DEATHMETALGORE","followers_url":"https://api.github.com/users/DEATHMETALGORE/followers","following_url":"https://api.github.com/users/DEATHMETALGORE/following{/other_user}","gists_url":"https://api.github.com/users/DEATHMETALGORE/gists{/gist_id}","starred_url":"https://api.github.com/users/DEATHMETALGORE/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DEATHMETALGORE/subscriptions","organizations_url":"https://api.github.com/users/DEATHMETALGORE/orgs","repos_url":"https://api.github.com/users/DEATHMETALGORE/repos","events_url":"https://api.github.com/users/DEATHMETALGORE/events{/privacy}","received_events_url":"https://api.github.com/users/DEATHMETALGORE/received_events","type":"User","site_admin":false},"created_at":"2015-10-25T10:01:33Z","updated_at":"2015-10-25T10:01:33Z","body":"OK I found the issue here.\r\n\r\nSo basically, we use this to fetch the header:\r\n```\r\n$this->getRequest()->headers->get('Authorization')\r\n```\r\nWhich is fine in most cases, except this one. I logged the following value like this:\r\n```\r\nerror_log(print_r(getallheaders(), true));\r\n```\r\nAnd the output is like this:\r\n```\r\n[25-Oct-2015 09:56:50 UTC] Array\r\n(\r\n    [Host] => localhost\r\n    [Connection] => keep-alive\r\n    [User-Agent] => Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36\r\n    [Accept] => */*\r\n    [X-CSRF-Token] => null\r\n    [Authorization] => Bearer OV5RD0Eadc5WazTs36QuO08tCh5fxmv5vOs4q3RH\r\n    [X-Requested-With] => XMLHttpRequest\r\n    [Referer] => http://localhost/api/public/\r\n    [Accept-Encoding] => gzip, deflate, sdch\r\n    [Accept-Language] => en-US,en;q=0.8,de;q=0.6,sq;q=0.4,sr;q=0.2\r\n    [Cookie] => refreshToken=eyJpdiI6ImRHeGZ5WmlGb0VPeE5CZUx6SFVwdHc9PSIsInZhbHVlIjoiRmpSQmxwd2tDVmtTQ2V0Kzg1MEdzcllNbTRScys0SStuRFJENFwvQXNIRmJJMXlvKzUzNW9mQkV0Y0VQQjg5aTlxVUR2ZEk0cVFFMHZaT2ZWQnp2V25UbmJ6MXhRZ3hmcWFaazd3N1RkYnhrdFRTTVNPbHdRNUhHR0IweHFaUzdJd1l4UzNVRzg2ajdkRWk5OHZ4RllGMklvSk5YenEzME1uRXFcL2dZNTFpbG5ZcXFWd0FLWWx3U1lMbHhibU0zb3VkbGkrWExoN28rTkJyOERJU1wveGx1cXVhTkdNeW1yTmt0Q2dzXC9RM0cxQThFeHNCenRtVFlzUjRsY0JGdFVKV3NFSGRIb2VwQTM3eFBEY2VcL3dyVGErSHp5a3JEU3d1eWUrZ2Z6NURaZzRCRVZHdHE3Tk5kSHp0RjBmVVczeUV5TldxdmJOODBYa2pKcW53YW13ZHZlRkI2MzVNT1lHTmtyKzdYM0lWd1NqMEJtUnpmM2dSeFo3NVZFQzlINnFITzIiLCJtYWMiOiJlZmVhOTFmYmNmOTFmNmU1N2Y4MzExYTg5ZWNkM2QxNGViZDNkYmY5OTU5ZDg5ZDU5MWIxYzY0MGQ4NTE4ODFhIn0%3D\r\n)\r\n```\r\nWhy would Lumen not take the Authorization header?"}}