Source:
<code>private void processBasicAuth(HttpServletRequest servletRequest, HttpServletResponse servletResponse, FilterChain filterChain) { boolean requireAuth = true; try { String header = servletRequest.getHeader("Authorization"); if (tokenService.isBasicAuthToken(header)) { String base64Token = tokenService.getBasicToken(header); String token = new String(Base64.decodeBase64(base64Token), StandardCharsets.UTF_8); String username = ""; String password = ""; int delim = token.indexOf(":"); if (delim != -1) { username = URLDecoder.decode(token.substring(0, delim), Util.UTF8_STRING_ENCODING); password = URLDecoder.decode(token.substring(delim + 1), Util.UTF8_STRING_ENCODING); } requireAuth = !StringHelper.equals(username, identity.getCredentials().getUsername()) || !identity.isLoggedIn(); if (requireAuth) { if (!username.equals(identity.getCredentials().getUsername()) || !identity.isLoggedIn()) { identity.getCredentials().setUsername(username); identity.getCredentials().setPassword(password); if (servletRequest.getRequestURI().endsWith("/token") || servletRequest.getRequestURI().endsWith("/revoke") || servletRequest.getRequestURI().endsWith("/revoke_session") || servletRequest.getRequestURI().endsWith("/userinfo") || servletRequest.getRequestURI().endsWith("/bc-authorize") <START> || servletRequest.getRequestURI().endsWith("/device-authorization")) { <END> Client client = clientService.getClient(username); if (client == null || AuthenticationMethod.CLIENT_SECRET_BASIC != client.getAuthenticationMethod()) { throw new Exception("The Token Authentication Method is not valid."); } requireAuth = !authenticator.authenticateClient(servletRequest); } else { requireAuth = !authenticator.authenticateUser(servletRequest); } } } } if (!requireAuth) { filterChain.doFilter(servletRequest, servletResponse); return; } } catch (Exception ex) { log.info("Basic authentication failed", ex); } if (requireAuth && !identity.isLoggedIn()) { sendError(servletResponse); } }</code><technical_language>In RFC references /device_authorization. Lets stick it</technical_language>

Target:
private void processBasicAuth(HttpServletRequest servletRequest, HttpServletResponse servletResponse, FilterChain filterChain) { boolean requireAuth = true; try { String header = servletRequest.getHeader("Authorization"); if (tokenService.isBasicAuthToken(header)) { String base64Token = tokenService.getBasicToken(header); String token = new String(Base64.decodeBase64(base64Token), StandardCharsets.UTF_8); String username = ""; String password = ""; int delim = token.indexOf(":"); if (delim != -1) { username = URLDecoder.decode(token.substring(0, delim), Util.UTF8_STRING_ENCODING); password = URLDecoder.decode(token.substring(delim + 1), Util.UTF8_STRING_ENCODING); } requireAuth = !StringHelper.equals(username, identity.getCredentials().getUsername()) || !identity.isLoggedIn(); if (requireAuth) { if (!username.equals(identity.getCredentials().getUsername()) || !identity.isLoggedIn()) { identity.getCredentials().setUsername(username); identity.getCredentials().setPassword(password); if (servletRequest.getRequestURI().endsWith("/token") || servletRequest.getRequestURI().endsWith("/revoke") || servletRequest.getRequestURI().endsWith("/revoke_session") || servletRequest.getRequestURI().endsWith("/userinfo") || servletRequest.getRequestURI().endsWith("/bc-authorize") || servletRequest.getRequestURI().endsWith("/device_authorization")) { Client client = clientService.getClient(username); if (client == null || AuthenticationMethod.CLIENT_SECRET_BASIC != client.getAuthenticationMethod()) { throw new Exception("The Token Authentication Method is not valid."); } requireAuth = !authenticator.authenticateClient(servletRequest); } else { requireAuth = !authenticator.authenticateUser(servletRequest); } } } } if (!requireAuth) { filterChain.doFilter(servletRequest, servletResponse); return; } } catch (Exception ex) { log.info("Basic authentication failed", ex); } if (requireAuth && !identity.isLoggedIn()) { sendError(servletResponse); } }