"application/vnd.unity",
				"application/vnd.uoml+xml",
				"application/vnd.uplanet.alert",
				"application/vnd.uplanet.alert-wbxml",
				"application/vnd.uplanet.bearer-choice",
				"application/vnd.uplanet.bearer-choice-wbxml",
				"application/vnd.uplanet.cacheop",
				"application/vnd.uplanet.cacheop-wbxml",
				"application/vnd.uplanet.channel",
				"application/vnd.uplanet.channel-wbxml",

            }
        }
        final HttpServletResponse response = LaResponseUtil.getResponse();
        if (t instanceof final InvalidAccessTokenException e) {
            response.setHeader("WWW-Authenticate", "Bearer error=\"" + e.getType() + "\"");
            writeJsonResponse(HttpServletResponse.SC_UNAUTHORIZED, message);
        } else {
            writeJsonResponse(status, message);
        }
    }

		xdstest.ValidateRoutes(t, routes)
		g.Expect(err).NotTo(HaveOccurred())
		g.Expect(len(routes)).To(Equal(1))
		g.Expect(routes[0].GetMatch().GetHeaders()[0].GetStringMatch().GetSafeRegex().GetRegex()).To(Equal("Bearer .+?\\..+?\\..+?"))
	})

	t.Run("for virtual service with regex matching on without_header", func(t *testing.T) {
		g := NewWithT(t)
		cg := core.NewConfigGenTest(t, core.TestOptions{})

      "type": "string",
      "format": "date-time"
    }
  },
  "securityDefinitions": {
    "BearerToken": {
      "description": "Bearer Token authentication",
      "type": "apiKey",
      "name": "authorization",
      "in": "header"
    }
  },
  "security": [{ "BearerToken": [] }]

        "format": "date-time",
        "type": "string"
      }
    },
    "securitySchemes": {
      "BearerToken": {
        "description": "Bearer Token authentication",
        "in": "header",
        "name": "authorization",
        "type": "apiKey"
      }
    }
  },
  "info": {
    "title": "Kubernetes",
    "version": "unversioned"

				opts := echo.CallOptions{
					Address: "kubernetes.default.svc",
					Port:    echo.Port{ServicePort: 443},
					Scheme:  scheme.HTTPS,
					HTTP: echo.HTTP{
						Headers: headers.New().With("Authorization", "Bearer "+token.Status.Token).Build(),
						Path:    "/",
					},
					// Test that we see our own identity -- not the ztunnel (istio-system/ztunnel).