some button in dashboard does not work if we have Spring Cloud Gateway(enabled with basic auth) set in front of SCDF

[amberHuang-arc]

We set up a SCG in front of SCDF so we can have basic auth set up to protect the dashboard page, then we found that many button in dashboard does not work, especially for button with any POST, PUT, DELETE action. in browser inspect page, we can see the request header missing referrer info so the Referer Policy becomes "no-referrer" instead of "strict-origin-when-cross-origin", But even we added the ReferrerHeader in SCG global filter, I still did not see the referrer showed in the SCDF request header, in SCG debug log, I can see below info: 9999 is the SCG port, 9393 is SCDF dashboard port
Referer header is missing
Referer: http://localhost:9999/dashboard/index.html
2024-05-23T10:34:52.144-07:00 DEBUG 44366 --- [scdf-gateway] [ctor-http-nio-5] g.f.h.o.ObservedRequestHttpHeadersFilter : Will instrument the HTTP request headers [Host:"localhost:9999", sec-ch-ua:""Chromium";v="124", "Google Chrome";v="124", "Not-A.Brand";v="99"", Accept:"application/json", Content-Type:"application/json", X-Requested-With:"XMLHttpRequest", sec-ch-ua-mobile:"?0", User-Agent:"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36", sec-ch-ua-platform:""macOS"", Sec-Fetch-Site:"same-origin", Sec-Fetch-Mode:"cors", Sec-Fetch-Dest:"empty", Accept-Encoding:"gzip, deflate, br, zstd", Accept-Language:"en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7", Cookie:"NG_TRANSLATE_LANG_KEY=en; JSESSIONID=DFEF14C9388A049F91F69ED47128F00A; SESSION=a87d0c10-4cf9-4ba0-af0c-614668fb10dd", Referer:"http://localhost:9999/dashboard/index.html", Forwarded:"proto=http;host="localhost:9999";for="[0:0:0:0:0:0:0:1]:63666"", X-Forwarded-For:"0:0:0:0:0:0:0:1", X-Forwarded-Proto:"http", X-Forwarded-Port:"9999", X-Forwarded-Host:"localhost:9999"]

[amberHuang-arc]

one of such failure example:
Request URL:
http://localhost:9999/apps?uri=https://dataflow.spring.io/task-maven-latest&force=false
Request Method:
POST
Status Code:
403 Forbidden
Remote Address:
[::1]:9999
Referrer Policy:
no-referrer

[amberHuang-arc]

Here is the sample code.
scg_scdf.tar.gz