User token missing during DKE Decryption API calls

Question

I have developed a Java-based REST API service for Double Key Encryption (DKE) key management.

While encryption and decryption functions are working correctly using this service, I am encountering an issue where the user authentication/authorization token is missing from the request header when the decryption API is called. This token is required for verification as specified in the official documentation.

Current Environment:

Service: Java-based REST API for DKE.

Connection: Secure HTTPS communication.

Domain: Using a verified domain on Azure.

Despite the setup following the standard protocol, the client is not passing the bearer token to our service. What could be the reason why the token is not being delivered from the client side during the decryption process?

Moderator note: Moved from Microsoft 365 and Office Development Other

Answer 1

The issue of the missing user authentication/authorization token during DKE decryption API calls could be due to several factors:

1. Client-Side Implementation: Ensure that the client making the API call is correctly configured to include the bearer token in the request header. This often involves checking the code that constructs the HTTP request to ensure the token is being appended correctly.
2. Token Expiration: If the token has expired, the client might not be sending it. Verify that the token is valid and has not expired before the API call is made.
3. CORS Policy: If the client is a web application, ensure that the Cross-Origin Resource Sharing (CORS) policy allows the sending of authorization headers. Sometimes, browsers block such headers if not explicitly allowed.
4. Network Interference: Check if there is any middleware, proxy, or load balancer that might be stripping out the authorization headers from the request.
5. Debugging: Utilize logging on both the client and server sides to trace the request flow. This can help identify at what point the token is being lost.
6. API Gateway or Security Policies: If there is an API gateway or security policies in place, they might be configured to reject requests without a token or to modify headers in transit.

By reviewing these areas, you should be able to identify why the bearer token is not being delivered during the decryption process.