Subject: [OAUTH-WG] User agent flow missing optional scope parameter in response?

From: Andrew Arnott <[email-masked]>
Date: Mon, 7 Jun 2010 08:38:46 -0700

The web server flow includes an optional scope parameter in a success
response.  The user agent flow seems to be missing that.  If a single auth
server supports both flows, and actually leverages the capability in the web
server flow to change the set of granted scopes from the requested ones by
sending a new scope value, it will be unable to do so for user-agent
clients.

Is this intended?
--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death
your right to say it." - S. G. Tallentyre

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Tue, 15 Jun 2010 00:13:50 -0700

Added in -09.

From: [email-masked] [mailto:[email-masked]] On Behalf Of Andrew Arnott
Sent: Monday, June 07, 2010 8:39 AM
To: OAuth WG ([email-masked])
Subject: [OAUTH-WG] User agent flow missing optional scope parameter in response?

The web server flow includes an optional scope parameter in a success response.  The user agent flow seems to be missing that.  If a single auth server supports both flows, and actually leverages the capability in the web server flow to change the set of granted scopes from the requested ones by sending a new scope value, it will be unable to do so for user-agent clients.

Is this intended?
--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre