search

hiidef / oauth2app

Django OAuth 2.0 Server App. Please fork and improve!
https://github.com/hiidef/oauth2app
MIT License
271 stars 115 forks source link

Refreshing token with missing scope parameter clears scope #51

Open alexdutton opened 10 years ago

alexdutton commented 10 years ago

TokenGenerator._get_refresh_token doesn't leave the scope attribute on self.access_token alone if the request had no scope parameter (i.e. self.scope is None).

RFC 6749 says:

scope OPTIONAL. The scope of the access request as described by Section 3.3. The requested scope MUST NOT include any scope not originally granted by the resource owner, and if omitted is treated as equal to the scope originally granted by the resource owner.

Fix to be attached shortly…