# Why authorization header not included in request ? - Auth0

**URL:** <https://community.auth0.com/t/why-authorization-header-not-included-in-request-auth0/64435>\
**Category:** Get Help\
**Tags:** python, jwt, api, auth0, login\
**Created:** [June 14, 2021, 7:04am UTC](https://community.auth0.com/t/why-authorization-header-not-included-in-request-auth0/64435 "2021-06-14T07:04:21Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![faisalbahli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/faisalbahli/32/29985_2.png) [@faisalbahli](https://community.auth0.com/u/faisalbahli)\
**Post date:** [June 14, 2021, 7:04am UTC](https://community.auth0.com/t/why-authorization-header-not-included-in-request-auth0/64435/1 "2021-06-14T07:04:21Z")

</div>

I have been struggling with this problem for two weeks, Basically I have configured the auth0 settings with my Flask app which runs on local host.

So, I have the following two endpoints in my flask app:

- A **public endpoint** which requires no authentication process:

```auto
@APP.route("/api/public")
@cross_origin(headers=["Content-Type", "Authorization"])
def public():
    # No access token required to access this route
    
    response = "Hello from a public endpoint! You don't need to be authenticated to see this."
    return jsonify(message=response)

```

- A **private endpoint** which requires authentication:

```auto
@APP.route("/api/private")
@cross_origin(headers=["Content-Type", "Authorization"])
@cross_origin(headers=["Access-Control-Allow-Origin", "http://localhost:3000"])
@requires_auth
def private():
    # A valid access token is required to access this route
    
    response = "Hello from a private endpoint! You need to be authenticated to see this."
    return jsonify(message=response)

```

So here is the following scenario:

- I try to log in with the auth0 url that redirects me to universal login page for my app. After successful login, it redirects me to the private end point and I get 401 Un-authorized error.

Whenever I make this request with valid token from the browser it throws 401 error. With the same token, I call this endpoint using postman it works !!

The reason for that is this request from the browser is not including the Authorization header, unlike postman.

I really don’t understand why the browser is not including the Authorization header.

Can someone explains ?

**NOTE:** At first it was working using browser without any problems but suddenly it appeared somehow.

Since the private endpoint requires authentication, whenever I try to access the private end point this function is called:

```auto
def get_token_auth_header():
    """Obtains the access token from the Authorization Header
    """
    auth = request.headers.get("Authorization", None) # HERE IS THE PROBLEM OCCURRS
    print("REQUEST HEADERS: \n", request.headers)
    if not auth:
        raise AuthError({"code": "authorization_header_missing",
                        "description":
                            "Authorization header is expected"}, 401)

    parts = auth.split()

    if parts[0].lower() != "bearer":
        raise AuthError({"code": "invalid_header",
                        "description":
                            "Authorization header must start with"
                            " Bearer"}, 401)
    elif len(parts) == 1:
        raise AuthError({"code": "invalid_header",
                        "description": "Token not found"}, 401)
    elif len(parts) > 2:
        raise AuthError({"code": "invalid_header",
                        "description":
                            "Authorization header must be"
                            " Bearer token"}, 401)

    token = parts[1]
    return token

```

I have been struggling with this for almost two weeks, I tried everything.

I would really appreciate your help.

---

<div class="post-metadata">

**Author:** ![jesstemporal](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jesstemporal/32/66824_2.png) [@jesstemporal](https://community.auth0.com/u/jesstemporal)\
**Post date:** [June 24, 2021, 12:36pm UTC](https://community.auth0.com/t/why-authorization-header-not-included-in-request-auth0/64435/2 "2021-06-24T12:36:24Z")

</div>

Hi @faisalbahli

> [@faisalbahli](#):
>
> have the following two endpoints in my flask app

For webapps you’ll need to add the configuration for the authlib, so that you can authorize the redirects the browser does.

Here’s a link on how to do that and the further steps you’ll need:  
[https://auth0.com/docs/quickstart/webapp/python#initialize-authlib](https://auth0.com/docs/quickstart/webapp/python#initialize-authlib)

Let me know how it goes 😉

---

<div class="post-metadata">

**Author:** ![faisalbahli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/faisalbahli/32/29985_2.png) [@faisalbahli](https://community.auth0.com/u/faisalbahli)\
**Post date:** [June 27, 2021, 6:49am UTC](https://community.auth0.com/t/why-authorization-header-not-included-in-request-auth0/64435/3 "2021-06-27T06:49:11Z")

</div>

Hey, thank you for your effort. I implemented it and it works.  
I wanted to ask you if there is any way to provide the authorization header to the server from the dashboard settings ? Because if there is, it will be much simpler and without any additional libraries.

Thanks again.

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [June 28, 2021, 6:39am UTC](https://community.auth0.com/t/why-authorization-header-not-included-in-request-auth0/64435/4 "2021-06-28T06:39:10Z")

</div>

Unfortunately there isn’t

---

<div class="post-metadata">

**Author:** ![faisalbahli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/faisalbahli/32/29985_2.png) [@faisalbahli](https://community.auth0.com/u/faisalbahli)\
**Post date:** [June 28, 2021, 6:58am UTC](https://community.auth0.com/t/why-authorization-header-not-included-in-request-auth0/64435/5 "2021-06-28T06:58:13Z")

</div>

Thanks for responding Konrad!

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [June 28, 2021, 9:25am UTC](https://community.auth0.com/t/why-authorization-header-not-included-in-request-auth0/64435/6 "2021-06-28T09:25:02Z")

</div>

No worries! We’re here for you!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [July 13, 2021, 9:25am UTC](https://community.auth0.com/t/why-authorization-header-not-included-in-request-auth0/64435/7 "2021-07-13T09:25:28Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.