GitHub - bilak/spring-oauth-userinfo: when using UserInfoTokenServices and its resttemplate is configured with AuthorizationCodeAccessTokenProvider and also with ClientCredentialsAccessTokenProvider then there's possibility to add whatever token and you will bypass security.

to reproduce:

start both applications
in command line execute curl -H 'Authorization: Bearer whatever' localhost:8080/hello (now you can see hello world)

then remove this line and repeat previous steps (you should not be able to see hello world).

Name		Name	Last commit message	Last commit date
Latest commit History 3 Commits
spring-oauth-userinfo-api		spring-oauth-userinfo-api
spring-oauth-userinfo-uaa		spring-oauth-userinfo-uaa
.gitignore		.gitignore
pom.xml		pom.xml
readme.md		readme.md

Provide feedback