oauth2-authorization-server

The server employs robust Spring Security features including JWT authentication, custom authentication providers, and session management with Redis. XSS prevention is implemented via `XssRequestWrapper` and `XssSanitizerUtils`, and HTTP security headers (X-XSS-Protection, Content-Security-Policy) are configured. Sensitive configurations like database credentials, API keys, and LDAP settings are externalized through environment variables, with safe defaults for development. RSA keys for JWT are loaded or generated on startup and stored locally, which is generally secure if the `jwt.key.path` is adequately protected. No direct hardcoded production secrets or `eval`-like dangerous patterns were found. The `logout` endpoint's redirect behavior, while standard for Spring Security, relies on the `referer` header which should ideally be validated further, though XSS filters provide some mitigation.