Skip to content
This repository has been archived by the owner on Jan 20, 2024. It is now read-only.

Scope parameter should not be sent when undefined #98

Closed
FMCorz opened this issue Feb 14, 2019 · 0 comments · Fixed by #154 or #156
Closed

Scope parameter should not be sent when undefined #98

FMCorz opened this issue Feb 14, 2019 · 0 comments · Fixed by #154 or #156
Assignees
@postatum
Labels
enhancement

Comments

@FMCorz
Copy link

FMCorz commented Feb 14, 2019

When the scope is undefined, its parameter is still set and send through as an empty string. The RFC states that the scope parameter can be omitted. I suggest that an undefined scope should not be attached to the request as an empty string.

If the client omits the scope parameter when requesting
authorization, the authorization server MUST either process the
request using a pre-defined default value or fail the request
indicating an invalid scope.

https://tools.ietf.org/html/rfc6749#section-3.3
@postatum postatum mentioned this issue Jul 27, 2020
Merged
@postatum postatum self-assigned this Jul 27, 2020
postatum added a commit that referenced this issue Aug 3, 2020
@postatum
Fixes #98: Do not send empty scopes to an auth server (#154)
a237644 
If `scopes` is set to `""` or `[]` then we should send an empty string.
If `scopes` is undefined (not set), then we don't send it at all.
@postatum postatum mentioned this issue Aug 3, 2020
Merged
clancy-au pushed a commit to digiwise/js-client-oauth2 that referenced this issue Apr 21, 2021
@postatum @clancy-au
Fixes mulesoft-labs#98: Do not send empty scopes to an auth server (m…
d87114e 
…ulesoft-labs#154)

If `scopes` is set to `""` or `[]` then we should send an empty string.
If `scopes` is undefined (not set), then we don't send it at all.
@mbrinkl mbrinkl mentioned this issue Jun 5, 2023
Closed
# for free to subscribe to this conversation on GitHub. Already have an account? #.
Assignees

@postatum postatum

Labels
enhancement
Projects
None yet
Milestone
No milestone
2 participants
@FMCorz @postatum