This pull request adds an integration test method testUserInfoWithMultipleAuthorizationHeaders to the OpenIdUserInfoTestCase test class. The test validates that HTTP requests containing multiple Authorization headers sent to the UserInfo endpoint are rejected with a 400 Bad Request response status.

The test method:

• Constructs a GET request to the appropriate UserInfo endpoint based on tenant configuration
• Sets standard HTTP headers (User-Agent and Content-Type)
• Adds two separate Authorization headers to simulate duplicate header scenarios
• Asserts that the response status code is 400
• Properly consumes the response entity

The test depends on the testGetAccessToken method to ensure a valid access token is available. This test case validates HTTP specification compliance for the UserInfo endpoint by ensuring it properly rejects malformed requests containing duplicate header values.

Walkthrough

A new TestNG integration test method, testUserInfoWithMultipleAuthorizationHeaders, is added to OpenIdUserInfoTestCase. The method constructs a GET request to the UserInfo endpoint (resolved based on tenant domain), attaches standard User-Agent and Content-Type headers, and deliberately includes two Authorization headers — one carrying the valid accessToken and one carrying invalid_token. It asserts that the response status code is 400 (Bad Request) and consumes the response entity.

❌ Failed checks (1 warning)

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

• X
• Mastodon
• Reddit
• LinkedIn