{"action":"created","issue":{"url":"https://api.github.com/repos/dmfs/oauth2-essentials/issues/36","repository_url":"https://api.github.com/repos/dmfs/oauth2-essentials","labels_url":"https://api.github.com/repos/dmfs/oauth2-essentials/issues/36/labels{/name}","comments_url":"https://api.github.com/repos/dmfs/oauth2-essentials/issues/36/comments","events_url":"https://api.github.com/repos/dmfs/oauth2-essentials/issues/36/events","html_url":"https://github.com/dmfs/oauth2-essentials/issues/36","id":270426424,"number":36,"title":"OAuth2AccessToken#scope() returns requested, not the issued scope","user":{"login":"chludwig-haufe","id":4521961,"avatar_url":"https://avatars3.githubusercontent.com/u/4521961?v=4","gravatar_id":"","url":"https://api.github.com/users/chludwig-haufe","html_url":"https://github.com/chludwig-haufe","followers_url":"https://api.github.com/users/chludwig-haufe/followers","following_url":"https://api.github.com/users/chludwig-haufe/following{/other_user}","gists_url":"https://api.github.com/users/chludwig-haufe/gists{/gist_id}","starred_url":"https://api.github.com/users/chludwig-haufe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chludwig-haufe/subscriptions","organizations_url":"https://api.github.com/users/chludwig-haufe/orgs","repos_url":"https://api.github.com/users/chludwig-haufe/repos","events_url":"https://api.github.com/users/chludwig-haufe/events{/privacy}","received_events_url":"https://api.github.com/users/chludwig-haufe/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2017-11-01T19:39:17Z","updated_at":"2017-11-02T15:44:56Z","closed_at":"2017-11-02T15:34:47Z","author_association":"NONE","body":"Hi,\r\n\r\nan \"_authorization server MAY fully or partially ignore the scope requested by the client_\" [[RFC6749, Sect. 3.3](https://tools.ietf.org/html/rfc6749#section-3.3)]. In the authorization server's access token response, the scope field is \"_OPTIONAL, if identical to the scope requested by the client; otherwise, REQUIRED_\" [[RFC6749, Sect. 5.1](https://tools.ietf.org/html/rfc6749#section-5.1)].\r\n\r\nI have a client that obtains an access token using the client credentials flow, using oauth-essentials 0.8. The scope issued by the authorization server is in fact different from the requested scope. \r\n\r\nWith the debugger, I can see the issued scope in the field `JsonAccessToken#mTokenresponse`. However, if I try to inspect the scope programatically by calling `OAuth2AccessToken#scope()`, I get the value of the field `JsonAccessToken#mScope` which is passed in (via `TokenResponseHandler` from `ClientCredentialsTokenRequest`.\r\n\r\nIs this a bug or did I miss something?\r\n\r\nCheers,\r\nChristoph"},"comment":{"url":"https://api.github.com/repos/dmfs/oauth2-essentials/issues/comments/341464283","html_url":"https://github.com/dmfs/oauth2-essentials/issues/36#issuecomment-341464283","issue_url":"https://api.github.com/repos/dmfs/oauth2-essentials/issues/36","id":341464283,"user":{"login":"dmfs","id":1614987,"avatar_url":"https://avatars3.githubusercontent.com/u/1614987?v=4","gravatar_id":"","url":"https://api.github.com/users/dmfs","html_url":"https://github.com/dmfs","followers_url":"https://api.github.com/users/dmfs/followers","following_url":"https://api.github.com/users/dmfs/following{/other_user}","gists_url":"https://api.github.com/users/dmfs/gists{/gist_id}","starred_url":"https://api.github.com/users/dmfs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dmfs/subscriptions","organizations_url":"https://api.github.com/users/dmfs/orgs","repos_url":"https://api.github.com/users/dmfs/repos","events_url":"https://api.github.com/users/dmfs/events{/privacy}","received_events_url":"https://api.github.com/users/dmfs/received_events","type":"User","site_admin":false},"created_at":"2017-11-02T15:44:56Z","updated_at":"2017-11-02T15:44:56Z","author_association":"OWNER","body":"Fixed in 0.8.1"}}
{"actor":{"display_login":"dmfs"}}