security-oauth-scopes-when-an-oauth-client-attempts-authorization-but-do-4d9b3110

THEN Implement a scope selection strategy: (1) Extract and use the scope from the 401 WWW-Authenticate header if present; (2) Otherwise omit the scope parameter to let the server apply its defaults; (3) If an invalid_scope error is received, fall back to requesting all supported_scopes from the resource metadata. Also ensure the server provides default scopes when scope is omitted.

function selectScope(challengeHeader, supportedScopes, clientDefault) {
  // 1. Challenge scope takes priority
  const challengeScope = extractChallengeScope(challengeHeader);
  if (challengeScope) return challengeScope;
  // 2. Use client default if set, otherwise omit
  const scope = clientDefault || undefined;
  if (scope) return scope;
  // 3. Fallback if server returns invalid_scope
  // (handled in error handler)
  return undefined;
}
// On invalid_scope error, retry with all supported scopes:
if (error === 'invalid_scope') {
  return selectAllScopes(supportedScopes);
}