==============================================================================
docs/output/04-gateway-token-relay.txt
Spring Cloud Gateway Server MVC with 'filters: - TokenRelay='.
GET /edge/relay through the gateway on 8080.
==============================================================================

$ curl -H "Authorization: Bearer $TOKEN" 127.0.0.1:8080/edge/relay
HTTP/1.1 200 
cache-control: no-cache, no-store, max-age=0, must-revalidate
expires: 0
pragma: no-cache
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 0
Content-Type: application/json

{
    "strategy": "bearer token relayed from the incoming request",
    "downstream": {
        "service": "downstream:8082",
        "strictValidation": false,
        "sub": "alice",
        "aud": [
            "downstream-api"
        ],
        "iss": "http://127.0.0.1:9000",
        "scope": "[orders.write, orders.read]",
        "client_id": null,
        "authorities": [
            "SCOPE_orders.read",
            "FactorGrantedAuthority [authority=FACTOR_BEARER, issuedAt=<timestamp>]",
            "SCOPE_orders.write"
        ],
        "cnf": null,
        "orders": [
            {
                "total": "42.00",
                "id": 1
            }
        ]
    }
}

$ curl 127.0.0.1:8080/edge/relay          # no Authorization header at all
status 401

# and the identical route with the TokenRelay filter REMOVED:
$ curl -H "Authorization: Bearer $TOKEN" 127.0.0.1:8080/norelay/x
{
    "strategy": "bearer token relayed from the incoming request",
    "downstream": {
        "service": "downstream:8082",
        "strictValidation": false,
        "sub": "alice",
        "aud": [
            "downstream-api"
        ],
        "iss": "http://127.0.0.1:9000",
        "scope": "[orders.write, orders.read]",
        "client_id": null,
        "authorities": [
            "SCOPE_orders.read",
            "FactorGrantedAuthority [authority=FACTOR_BEARER, issuedAt=<timestamp>]",
            "SCOPE_orders.write"
        ],
        "cnf": null,
        "orders": [
            {
                "total": "42.00",
                "id": 1
            }
        ]
    }
}

# TokenRelay relays the access token of the currently authenticated USER - the one
# obtained by oauth2Login(). This gateway has no oauth2Login, so there is no
# authorized client to read a token from, and the filter contributes nothing. What
# reaches the edge service is whatever Authorization header the caller sent, because
# the gateway proxied it. TokenRelay is not 'forward the incoming bearer token'.