Cakephp 4: JWT Authorization fails in Browser, Postman works - php

Question

I'm having trouble migrating my Backend CakePHP App, from CakePHP 3.9 to CakePHP 4.
The App serves as an API for my sveltejs/sapper Javascript Application.
As for the JWT Authentication I'm using the admad/cakephp-jwt-auth plugin.
The App before Migration works perfectly from the browser as the frontend.
Testing my API in Postman works for both CakePHP 3 and 4 versions.
After migration however, requests sent from the browser (sveltejs/sapper) and where Authentication is needed (Authorization header containing the Bearer token) result in an error:
Error 401 "Authorization failed
My CORS Middleware (ozee31/cakephp-cors plugin) also seems to be working since requests that don't need to be authorized just work as expected, also from the browser - unplugging CORS middleware result in an CORS error in the browser for those requests.
Also, my server is populating $_SERVER['HTTP_AUTHORIZATION']
Has anyone successfully implemented a similar setup, especially when it comes to CakePHP 4 and HTTP_AUTHORIZATION header yet?

Answer 1

I created a own JWT plugin for CakePHP 4 that worked as a component.
https://github.com/WireCore/CakePHP_JWT
It's currently in alpha but you can try if it solved your problem.
You can install it with composer composer require wirecore/cakephp_jwt and add it in your Application.php via $this->addPlugin('Wirecore/CakePHP_JWT'); You find more details in the README

Answer 2

Cors error can be fixed in following way .
In AppController.php
private function setCorsHeaders()
{
$this->response = $this->response->cors($this->request)
->allowOrigin(['*'])
->allowMethods(['*'])
->allowHeaders(['x-xsrf-token', 'Origin', 'Content-Type', 'X-Auth-Token', 'authorization'])
->allowCredentials(['true'])
->exposeHeaders(['Link'])
->maxAge(300)
->build();
}
public function beforeRender(EventInterface $event)
{
// .......
$this->setCorsHeaders();
}
public function beforeFilter(EventInterface $event)
{
// ......
if ($this->request->is('OPTIONS')) {
$this->setCorsHeaders();
return $this->response;
}
}
In config/Bootstrap.php add this line al last line og file.
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Headers: *");