For me, the problem was that I sent an empty authorization header.
My application login (AngularJS SPA) sends the username / password in the JSON object, and if the login is valid, it returns a JWT, which is then used for the authorization header - for example, Bearer {JWT} for future API requests.
Not sending the authorization header when there was nothing to send fixed the problem.
source share