error 401 for route api/auth/me

[chrisvidal]

The login part seems to be working, my vuejs app receives a token then try to access the route api/auth/me but receives a 401 No token provided

When I look at the API response, I can see that the header is containing the token as such: this is the javascript log of the 401 error returned by the API:

config:
...
  data: undefined
  headers:
    Accept: "application/json, text/plain, */*"
    Authorization: "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwOlwvXC9vYy1kcm9uZXQubG9jYWxcL2FwaVwvYXV0aFwvbG9naW4iLCJpYXQiOjE1ODg5MTkwMDEsImV4cCI6MTU4ODkyMjYwMSwibmJmIjoxNTg4OTE5MDAxLCJqdGkiOiJreFRQMVhSQkNwWEtITDdSIiwic3ViIjoxLCJwcnYiOiI0MTFjOTE3YTBmYjUxZTBhNDI3YTdlM2RlYWE1YTQ5ZTI5MmRkYjliIn0.vSWvZbrntyRNl-3Zy3XzBk-yZhCswpNFGW3Jwjjcdbs"
    X-Requested-With: "XMLHttpRequest"
    __proto__: Object
    maxContentLength: -1
    method: "get"
    timeout: 0
...
    url: "api/auth/me"
...
  data: ""Token not provided" on line 52 of /Users/christ/Sites/oc-dronet/plugins/rluders/jwtauth/vendor/tymon/jwt-auth/src/Http/Middleware/BaseMiddleware.php"
...
  status: 401
  statusText: "Unauthorized"

[rluders]

Thanks for reporting it @chrisvidal - I'll try to check it ASAP, but if you want to submit a PR to fix it, I'll accept it.

[chrisvidal]

I'd love to. I traced back until the Tymon library. It seems that the request headers is not passed properly to the jwt library parsing the token. That's I got so far

[rluders]

I was checking it and I just remember that you opened the same issue once in the past. https://github.com/rluders/oc-jwtauth-plugin/issues/1

Can you confirm if the issue is the same and if the proposed solution solves it?

[chrisvidal]

oh you are right - I didn't manage to solve it at that time.

Using Apache, I tried to insert this piece of code but it does not work either

RewriteCond %{HTTP:Authorization} ^(.)
RewriteRule . - [e=HTTP_AUTHORIZATION:%1]

[chrisvidal]

ok after hours of research, it is due to Apache 2.2.

the correct .htaccess that works for me is

    RewriteCond %{HTTP:Authorization} ^(.*)
    RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]

which is slightly different from the one provided by the Tymon JWT

[chrisvidal]

I think it should be mentioned in the documentation here, what do you think?

[rluders]

I agree.