feat(auth): support custom scope in authorization requests #491
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add support for specifying custom OAuth scopes during authorization requests, separating client registration metadata from authorization request parameters.
Motivation and Context
Previously, the authorization request was hardcoded to use the scope from client metadata (
clientMetadata.scope
)(in #464), which incorrectly mixed two different OAuth 2.0 concepts:This change properly separates these concerns by:
This better aligns with OAuth 2.0 specification where authorization request scopes and client registration metadata serve different purposes.
How Has This Been Tested?
Existing unit tests passed.
Breaking Changes
No. If the scope is not provided, it will fallback to
clientMetadata.scope
.Types of changes
Checklist
Additional context
This change focuses on architectural correctness in OAuth 2.0 implementation by properly separating client registration metadata from authorization request parameters. While this is a breaking change, it enforces better OAuth 2.0 practices by making scope requirements explicit in authorization requests.
Migration guide: