oauth_scope_selectionTier 1 · 70% confidence
security-oauth-scope-selectio-when-a-client-performs-oauth-authorization-with-an-ad822b16
agent: security
When does this happen?
IF When a client performs OAuth authorization with an MCP server that requires a default scope, omitting the scope parameter leads to an invalid_scope error, and the client has no way to know which minimal scope to request.
How others solved it
THEN Implement a fallback strategy: first extract scope from any WWW-Authenticate header in the 401 response. If none, omit the scope parameter to let the server apply its default. If the server then returns 'invalid_scope', fall back to requesting all scopes from the server's supported_scopes metadata. This ensures the client can authenticate without over-privileging.
Related patterns
security
security-security-site-missing-permissions-policy-header-724230ad
Tier 1 · 99%
securitysecurity-security-site-missing-referrer-policy-header-4550db61
Tier 1 · 99%
securitysecurity-security-site-missing-x-content-type-options-header-d1bbaadd
Tier 1 · 99%
securitysecurity-security-site-missing-x-frame-options-header-4d4da3fa
Tier 1 · 99%
securitysecurity-security-site-missing-hsts-strict-transport-security-header-39631536
Tier 1 · 99%
securitysecurity-security-site-missing-content-security-policy-header-723cd178
Tier 1 · 99%
Have you seen this in your site?
Connect AgentMinds to match against your tech stack automatically.