starred/yaak-mountain-loop
1
0
Fork 0
mirror of https://github.com/mountain-loop/yaak.git synced 2026-08-23 11:54:01 +02:00
Code Issues 8 Packages Projects Releases 10 Wiki Activity

Stop sending scope on the authorization code token request (#579)

Browse Source
This commit is contained in:
Gregory Schier
2026-08-17 12:23:08 -07:00
committed by GitHub
parent 33f32cccf6
commit 569f552d79
2 changed files with 100 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/auth-oauth2/src/fetchAccessToken.ts
+7 -1
View File
@@ -31,7 +31,13 @@ export async function fetchAccessToken(
],
};
if (scope) httpRequest.body?.form.push({ name: "scope", value: scope });
// RFC 6749 §4.1.3 doesn't define scope for the authorization code token
// request, so strict servers (OpenIddict) reject it outright. Scope belongs on
// the authorize request, which already sends it. Every other grant does define
// it: §4.3.2 password, §4.4.2 client credentials, §6 refresh.
if (scope && grantType !== "authorization_code") {
httpRequest.body?.form.push({ name: "scope", value: scope });
}
if (audience) httpRequest.body?.form.push({ name: "audience", value: audience });
if ("clientAssertion" in args) {