{"action":"opened","issue":{"url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/582","labels_url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/582/labels{/name}","comments_url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/582/comments","events_url":"https://api.github.com/repos/lucadegasperi/oauth2-server-laravel/issues/582/events","html_url":"https://github.com/lucadegasperi/oauth2-server-laravel/issues/582","id":113225998,"number":582,"title":"Authorization header not coming through","user":{"login":"DEATHMETALGORE","id":2448254,"avatar_url":"https://avatars.githubusercontent.com/u/2448254?v=3","gravatar_id":"","url":"https://api.github.com/users/DEATHMETALGORE","html_url":"https://github.com/DEATHMETALGORE","followers_url":"https://api.github.com/users/DEATHMETALGORE/followers","following_url":"https://api.github.com/users/DEATHMETALGORE/following{/other_user}","gists_url":"https://api.github.com/users/DEATHMETALGORE/gists{/gist_id}","starred_url":"https://api.github.com/users/DEATHMETALGORE/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DEATHMETALGORE/subscriptions","organizations_url":"https://api.github.com/users/DEATHMETALGORE/orgs","repos_url":"https://api.github.com/users/DEATHMETALGORE/repos","events_url":"https://api.github.com/users/DEATHMETALGORE/events{/privacy}","received_events_url":"https://api.github.com/users/DEATHMETALGORE/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-10-25T13:31:35Z","updated_at":"2015-10-25T13:31:35Z","closed_at":null,"body":"I have a little page that uses jQueryOAuth to make a request to my Lumen API that I made using this repository and following this guide:\r\n\r\nhttp://esbenp.github.io/2015/05/26/lumen-web-api-oauth-2-authentication/\r\n\r\nI can do the `login`, but when I try to get a resource it wont receive the `Authorization` header. I know it is sent because I monitor it via my Network tab in dev tools _Authorization: Bearer xxxx..._, but when I dump this:\r\n```\r\n$this->getRequest()\r\n```\r\nIt returns all headers except the `Authorization` one.\r\nThen I dumped the following value like this:\r\n```\r\nerror_log(print_r(getallheaders(), true));\r\n```\r\nAnd the output is like this:\r\n```\r\n[25-Oct-2015 09:56:50 UTC] Array\r\n(\r\n    [Host] => localhost\r\n    [Connection] => keep-alive\r\n    [User-Agent] => Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36\r\n    [Accept] => */*\r\n    [X-CSRF-Token] => null\r\n    [Authorization] => Bearer OV5RD0Eadc5WazTs36QuO08tCh5fxmv5vOs4q3RH\r\n    [X-Requested-With] => XMLHttpRequest\r\n    [Referer] => http://localhost/api/public/\r\n    [Accept-Encoding] => gzip, deflate, sdch\r\n    [Accept-Language] => en-US,en;q=0.8,de;q=0.6,sq;q=0.4,sr;q=0.2\r\n    [Cookie] => refreshToken=eyJpdiI6ImRHeGZ5WmlGb0VPeE5CZUx6SFVwdHc9PSIsInZhbHVlIjoiRmpSQmxwd2tDVmtTQ2V0Kzg1MEdzcllNbTRScys0SStuRFJENFwvQXNIRmJJMXlvKzUzNW9mQkV0Y0VQQjg5aTlxVUR2ZEk0cVFFMHZaT2ZWQnp2V25UbmJ6MXhRZ3hmcWFaazd3N1RkYnhrdFRTTVNPbHdRNUhHR0IweHFaUzdJd1l4UzNVRzg2ajdkRWk5OHZ4RllGMklvSk5YenEzME1uRXFcL2dZNTFpbG5ZcXFWd0FLWWx3U1lMbHhibU0zb3VkbGkrWExoN28rTkJyOERJU1wveGx1cXVhTkdNeW1yTmt0Q2dzXC9RM0cxQThFeHNCenRtVFlzUjRsY0JGdFVKV3NFSGRIb2VwQTM3eFBEY2VcL3dyVGErSHp5a3JEU3d1eWUrZ2Z6NURaZzRCRVZHdHE3Tk5kSHp0RjBmVVczeUV5TldxdmJOODBYa2pKcW53YW13ZHZlRkI2MzVNT1lHTmtyKzdYM0lWd1NqMEJtUnpmM2dSeFo3NVZFQzlINnFITzIiLCJtYWMiOiJlZmVhOTFmYmNmOTFmNmU1N2Y4MzExYTg5ZWNkM2QxNGViZDNkYmY5OTU5ZDg5ZDU5MWIxYzY0MGQ4NTE4ODFhIn0%3D\r\n)\r\n```\r\nThe header is there! As you might see in that guide, I use a proxy for the whole thing. Could that be clearing my `Authorization` header?\r\n\r\nJust made an external little application in NodeJS to invoke my API and I get this error now:\r\n```\r\nXMLHttpRequest cannot load http://localhost/api/public/login. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:3000' is therefore not allowed access.\r\n```\r\nI think I have some major glitch somewhere. Help would be appreciated."}}