I'm testing (in Postman) a basic username/password flow. I have created Managed App in Salesforce so I have all that I need to invoke token endpoint and get an access token:
So far so good. The process will return me an
access_token and some infos about it.
As far as I know the
id URL should be used to
- get extra info about user,
- identify the user,
So I invoke the identity URL for the first time and I get (as I suppose)
missingOAuthToken. Then I set
Authorization header with value
Bearer <access_token>, and now it works.
The strange things happen now: if I modify the access token, putting randomly char, altering the cahracters lenght when I send the request I'm still authorized. Why this happens? This would be too strange, and since I'm not into Salesforce, I'm probably missing something.