Spring Security Resource Server Practice

The /userinfo fallback that quietly made Auth0 a hard dependency on every request

Auth0 access tokens ship without an email claim. One team's fallback put a synchronous identity-provider call inside a per-request filter, and the cache in front of it hid the coupling rather than removing it.