{"action":"closed","issue":{"url":"https://api.github.com/repos/cloudfoundry/uaa/issues/179","labels_url":"https://api.github.com/repos/cloudfoundry/uaa/issues/179/labels{/name}","comments_url":"https://api.github.com/repos/cloudfoundry/uaa/issues/179/comments","events_url":"https://api.github.com/repos/cloudfoundry/uaa/issues/179/events","html_url":"https://github.com/cloudfoundry/uaa/issues/179","id":91874329,"number":179,"title":"Documentation states that HTTP Basic Auth is used, but it isn't","user":{"login":"ryanmoran","id":155736,"avatar_url":"https://avatars.githubusercontent.com/u/155736?v=3","gravatar_id":"","url":"https://api.github.com/users/ryanmoran","html_url":"https://github.com/ryanmoran","followers_url":"https://api.github.com/users/ryanmoran/followers","following_url":"https://api.github.com/users/ryanmoran/following{/other_user}","gists_url":"https://api.github.com/users/ryanmoran/gists{/gist_id}","starred_url":"https://api.github.com/users/ryanmoran/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ryanmoran/subscriptions","organizations_url":"https://api.github.com/users/ryanmoran/orgs","repos_url":"https://api.github.com/users/ryanmoran/repos","events_url":"https://api.github.com/users/ryanmoran/events{/privacy}","received_events_url":"https://api.github.com/users/ryanmoran/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-06-29T18:26:41Z","updated_at":"2015-07-10T18:59:51Z","closed_at":"2015-07-10T18:59:51Z","body":"The documentation states that the GET /token_key endpoint is protected by HTTP Basic Auth, but this is not actually the case:\r\n\r\n```bash\r\n→ curl -v -k https://uaa.example.cf-app.com/token_key\r\n* Hostname was NOT found in DNS cache\r\n*   Trying 52.7.245.225...\r\n* Connected to uaa.example.cf-app.com (52.7.245.225) port 443 (#0)\r\n* TLS 1.2 connection using TLS_RSA_WITH_AES_128_CBC_SHA256\r\n* Server certificate: *.10.244.0.34.xip.io\r\n> GET /token_key HTTP/1.1\r\n> User-Agent: curl/7.37.1\r\n> Host: uaa.example.cf-app.com\r\n> Accept: */*\r\n>\r\n< HTTP/1.1 200 OK\r\n< Access-Control-Allow-Origin: *\r\n< Cache-Control: no-cache, no-store, max-age=0, must-revalidate\r\n< Content-Type: application/json;charset=UTF-8\r\n< Date: Mon, 29 Jun 2015 18:22:54 GMT\r\n< Expires: 0\r\n< Pragma: no-cache\r\n* Server Apache-Coyote/1.1 is not blacklisted\r\n< Server: Apache-Coyote/1.1\r\n< Strict-Transport-Security: max-age=31536000 ; includeSubDomains\r\n< X-Cf-Requestid: c33c734c-e588-4122-656e-938454fcdfad\r\n< X-Content-Type-Options: nosniff\r\n< X-Frame-Options: DENY\r\n< X-Xss-Protection: 1; mode=block\r\n< Content-Length: 526\r\n<\r\n* Connection #0 to host uaa.mrorange.cfla.cf-app.com left intact\r\n{\"alg\":\"SHA256withRSA\",\"value\":\"-----BEGIN PUBLIC KEY-----\\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHFr+KICms+tuT1OXJwhCUmR2d\\nKVy7psa8xzElSyzqx7oJyfJ1JZyOzToj9T5SfTIq396agbHJWVfYphNahvZ/7uMX\\nqHxf+ZH9BL1gk9Y6kCnbM5R60gfwjyW1/dQPjOzn9N394zd2FJoFHwdq9Qs0wBug\\nspULZVNRxq7veq/fzwIDAQAB\\n-----END PUBLIC KEY-----\\n\",\"kty\":\"RSA\",\"use\":\"sig\",\"n\":\"AMcWv4ogKaz625PU5cnCEJSZHZ0pXLumxrzHMSVLLOrHugnJ8nUlnI7NOiP1PlJ9Mirf3pqBsclZV9imE1qG9n/u4xeofF/5kf0EvWCT1jqQKdszlHrSB/CPJbX91A+M7Of03f3jN3YUmgUfB2r1CzTAG6CylQtlU1HGru96r9/P\",\"e\":\"AQAB\"}\r\n```"}}