AuthorizationHeaderPayload should use getResponse()? about spring-webflux-security-jwt

[raphaelDL]

We use serverWebExchange.getRequest() because in this step we are filtering the current request, that's why we need to extract the contents form the Authorization Header.
Care to elaborate more about your question?

[monstrfolk]

After logging in the only authorization header I see in the request is "Basic dXNlcjp1c2Vy". This fails token validation at https://github.com/raphaelDL/spring-webflux-security-jwt/blob/master/src/main/java/io/rapha/spring/reactive/security/auth/jwt/JWTCustomVerifier.java#L45

[raphaelDL]

Yes, and in the response you’ll get a Bearer token in the authorization header, you copy/use that token in your next request instead of basic credentials

[raphaelDL]

You first login using basic in order to get a token, then put that token in another request authorization header to consume the api

[monstrfolk]

Thanks for explanation. The Mono.empty() was messing me up because api/* pages were returning data after login without Authorization header with Bearer.