Closed fromanu closed 5 years ago
This is standard behaviour of Kong - if a scope was not requested, the X-Authenticated-Scope
header is not sent along with the resulting access token. Non-presence of this header means empty scope.
What would your expected behaviour be? The "assigned scope" is an assignment of "allowed scopes". Other scopes will not be granted, but it does not mean that you automatically get a grant for this scope with the access token.
Closing this - it looks as if the question was answered. If there are further things, please open a new issue.
The following scenario was tested:
testAPI
.someScope
as the allowed scope for this subscription.scope
parameter in the body of the request.testAPI
.Result:
Expected:
x-authenticated-scope=[someScope]
) even if there is noscope
parameter in the body of the request.