{"action":"opened","issue":{"url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5376","repository_url":"https://api.github.com/repos/spring-projects/spring-boot","labels_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5376/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5376/comments","events_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5376/events","html_url":"https://github.com/spring-projects/spring-boot/issues/5376","id":139654809,"number":5376,"title":"Don't pre-emptively authenticate in JWT keyUri request","user":{"login":"william-tran","id":1084441,"avatar_url":"https://avatars.githubusercontent.com/u/1084441?v=3","gravatar_id":"","url":"https://api.github.com/users/william-tran","html_url":"https://github.com/william-tran","followers_url":"https://api.github.com/users/william-tran/followers","following_url":"https://api.github.com/users/william-tran/following{/other_user}","gists_url":"https://api.github.com/users/william-tran/gists{/gist_id}","starred_url":"https://api.github.com/users/william-tran/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/william-tran/subscriptions","organizations_url":"https://api.github.com/users/william-tran/orgs","repos_url":"https://api.github.com/users/william-tran/repos","events_url":"https://api.github.com/users/william-tran/events{/privacy}","received_events_url":"https://api.github.com/users/william-tran/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-03-09T18:02:24Z","updated_at":"2016-03-09T18:02:24Z","closed_at":null,"body":"https://github.com/spring-projects/spring-boot/blob/v1.4.0.M1/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/oauth2/resource/ResourceServerTokenServicesConfiguration.java#L285\r\n\r\nUAA will always check the client for uaa.resource authority if credentials are in the request to uaa/token_key, even if a request with no credentials would return 200, which happens when the verification key is a public key. If we tried the request without authentication first and then retry with credentials only if challenged, we could get around this behaviour in UAA. "}}