stopgap to prevent some leaks due to #492

openid-connect-common/src/main/java/org/mitre/openid/connect/web/UserInfoInterceptor.java

@@ -33,6 +33,7 @@ import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.web.servlet.ModelAndView;
 import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
+import org.springframework.web.servlet.view.RedirectView;
 
 import com.google.gson.Gson;
 import com.google.gson.GsonBuilder;
@@ -65,6 +66,10 @@ public class UserInfoInterceptor extends HandlerInterceptorAdapter {
 	public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
 
 		if (modelAndView != null) { // skip checking at all if we have no model and view to hand the user to
+
+			// TODO: this is a patch to get around a potential information leak from #492
+			if (!(modelAndView.getView() instanceof RedirectView)) {
+			
 				// get our principal from the security context
 				Principal p = request.getUserPrincipal();
 	
@@ -94,6 +99,7 @@ public class UserInfoInterceptor extends HandlerInterceptorAdapter {
 					}
 				}
 			}
+		}
 
 	}