to reproduce:
- start both applications
- in command line execute
curl -H 'Authorization: Bearer whatever' localhost:8080/hello(now you can see hello world)
then remove this line and repeat previous steps (you should not be able to see hello world).
-
Notifications
You must be signed in to change notification settings - Fork 1
when using UserInfoTokenServices and its resttemplate is configured with AuthorizationCodeAccessTokenProvider and also with ClientCredentialsAccessTokenProvider then there's possibility to add whatever token and you will bypass security.
bilak/spring-oauth-userinfo
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
About
when using UserInfoTokenServices and its resttemplate is configured with AuthorizationCodeAccessTokenProvider and also with ClientCredentialsAccessTokenProvider then there's possibility to add whatever token and you will bypass security.
Resources
Stars
Watchers
Forks
Releases
No releases published
Packages 0
No packages published