Zachary Sabourin · Zachary Sabourin
--- a/src/main/java/org/eclipsefoundation/openvsx/request/OAuthFilter.java
+++ b/src/main/java/org/eclipsefoundation/openvsx/request/OAuthFilter.java

            DrupalOAuthData tokenStatus = oauthService.validateTokenStatus(token, validScopes.get(),
                    validClientIds.get());
-            if (tokenStatus != null) {

-                // Set token data into context
-                requestContext.setProperty(RequestContextPropertyNames.TOKEN_STATUS, tokenStatus);
+            // The incoming token must have a user associated with it.
+            if (tokenStatus == null || tokenStatus.getUserId() == null) {
+                throw new FinalForbiddenException("Invalid user credentials");