Rest call requires JSESSIONID (Spring boot, Spring Security, OAuth2, Zuul)
<p>I have two spring-boot processes.  I have Spring Security enabled on both, and I'm using Spring Security OAuth2 SSO setup.  I'm also using Eureka and Zuul to allows calls into Boot1 to call into services in Boot2.  UI is using Angular with REST calls into the services, and the token being used is a Json Web Token.</p>

<p>This all seems to work, certainly in the UI.  All the requests use the Authorization header (which contains the JWT) and the spring security filter in the services successfully parse the JWT and extracts the Security Context from it.  As part of the Spring Web processing, it adds a JSESSIONID value to the client's cookie.</p>

<p>Recently, I only had Spring security on Boot1.  When calling rest services into Boot1, which end up using Zuul to forward requests to Boot2, all I required in the rest client was to include the Authorization header with the JWT and it all worked fine.</p>

<p>However, I have recently added Spring Security to Boot2 (using the @EnableResourceServer annotation) and now rest calls fail unless I have both the Authorization header as well as a Cookie header that contains a JSESSIONID value.  Calls don't fail, but they return empty values.</p>

<p>I've enabled logging to Spring Security, and it validates all correctly in Boot1.  It's going into the same ZuulFilter.  But there's no activity on Boot2.</p>

<p>Is there something in Zuul that requires a JSESSIONID value to be defined in order for it forward the request?  Or is this in Boot2, where it is expecting a JSESSIONID header value due to the introduction of Spring Security filters?</p>

<p>--- update --- </p>

<p>I've stepped through boot1.  From what I can see, code in the OAuth2TokenRelayFilter is throwing an exception.  Specifically, the method getAccessToken is calling restTemplate.getAccessToken().getValue (line 90, version 1.1.0-RELEASE) which throws a UserRedirectRequiredException.</p>

<p>So, while the TokenRelayFilter has a token, it's attempting to refresh it.  When it receives an exception, it's throwing a BadCredentialsException instead of using what's already been defined.</p>

<p>--- update 2 ---</p>

<p>Putting a breakpoint in OAuth2RestOperationsConfiguration, making rest calls without the JSESSIONID always ends up with a new DefaultOAuth2ClientContext to be created, as it's trying to create session-scoped beans.  With the JSESSIONID, it's using a persisted DefaultOAuth2ClientContext, which will have the context.</p>

<p>So, is it possible to, when constructing the DefaultOAuth2ClientContext, to see if the request contains the token and uses it?  Or something like this?  We're trying to move to stateless services, and this seems to be a hurdle towards this.</p>