search

KorAP / Kalamar

:octopus: Mojolicious-based Frontend for KorAP
BSD 2-Clause "Simplified" License
7 stars 2 forks source link

Handling unknown authorization scope #191

Closed margaretha closed 1 year ago

margaretha commented 1 year ago

Kalamar should disallow asking for unknown authorization scope

image

example request:

https://korap.ids-mannheim.de/instance/test/settings/oauth/authorize?client_id=clientId&redirect_uri=redirect_uri&response_type=code&state=ZMwDGTZ2RY&scope=unknown

Akron commented 1 year ago

I think the handling needs to be done in the backend. However, if we want to have a second step of access granting, where Kalamar reports, which scope are accepted and how the final redirect looks like, that should be doable in Kalamar. Having a separate background checking step or keeping a list of valid scopes in the frontend seems to be unnecessary to me.

Akron commented 1 year ago

For me, that's a wontfix.