I’m using Spring Security 6.3.1 and it seems cors is filtering out my authorization header. I made sure that the request from my webapp contains the header but when i try to get it in my JwtAuthorizationFilter the header is filtered out. A Postman call works as intended.
My WebSecurityConfiguration with the global cors settings looks like this:

@Configuration  
@EnableWebSecurity  
public class WebSecurityConfiguration {  
 
  @Bean  
  public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {  
  http.csrf(AbstractHttpConfigurer::disable).authorizeHttpRequests(authorizeRequests ->  
                authorizeRequests  
  .requestMatchers(HttpMethod.POST, "/diagram/**").authenticated()  
  .requestMatchers(HttpMethod.PUT, "/diagram/**").authenticated()  
  .anyRequest().permitAll()).addFilterBefore(jwtAuthorizationFilter(), UsernamePasswordAuthenticationFilter.class);  
  return http.build();  
  }  
  
  @Bean  
  public JwtAuthorizationFilter jwtAuthorizationFilter() {  
  return new JwtAuthorizationFilter();  
  }  
  
  @Bean  
  public CorsFilter corsFilter() {  
  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();  
  CorsConfiguration corsConfiguration = new CorsConfiguration();  
  corsConfiguration.setAllowedHeaders(List.of("*"));  
  corsConfiguration.addExposedHeader("Authorization");  
  corsConfiguration.setAllowedOrigins(Arrays.asList("*"));  
  corsConfiguration.setAllowedMethods(Arrays.asList("*"));  
  corsConfiguration.setMaxAge(Duration.ofMinutes(10));  
  source.registerCorsConfiguration("/**", corsConfiguration);  
  return new CorsFilter(source);  
  }  
}

And this is my jwtAuthorizationFilter()

@Component  
public class JwtAuthorizationFilter extends OncePerRequestFilter {  
  
  @Autowired  
  private SupabaseAuthService supabaseAuthService;  
  
  @Override  
  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {  
  
      String tokenFromRequest = parseJwt(request);  
      //...  
      filterChain.doFilter(request, response);  
  
  }  
  
  private String parseJwt(HttpServletRequest request) {  
     String headerAuth = request.getHeader("Authorization");  
      if (StringUtils.hasText(headerAuth) && headerAuth.startsWith("Bearer ")) {  
          return headerAuth.substring(7);  
      }  
      return null;  
  }  
}