Scope is specific to the access token, not the code. In fact, I expect some providers to issue an access token with a lesser scope than that provided when exchanging the authorization code later (which will include another scope). This is because the authorization server can authenticate the client when using the authorization code and provide greater access.
EHL From: [email protected] [mailto:[email protected]] On Behalf Of Andrew Arnott Sent: Friday, July 02, 2010 9:26 AM To: OAuth WG ([email protected]) Subject: [OAUTH-WG] End user auth response code-and-token's scope parameter If the response type is code-and-token, the authorization server adds the codeand state parameters to the redirection URI query component and theaccess_token, scope, and expires_in to the redirection URI fragment using theapplication/x-www-form-urlencoded format as defined by... Since the scope applies equally to both the code and access_token parameters, it seems that scope should be included in the URI query part so it is available to the web server as well as the user-agent. While the scope remains in the fragment, the client's web server won't know whether the full scope it requested was actually granted. Was there an advantage to including the scope only in the #fragment, or was this just an oversight? Thanks. -- Andrew Arnott "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre
_______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
