Requested scopes are lowercased when the SDK appends the `openid` scope
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 75/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Domain
- authentication
Research direction
Start with OidcUtils.includeRequiredScope and trace how ParameterBuilder.setScope and the request APIs use it. Compare the reproduced mixed-case scope with the result when openid is already present. Done means appending openid leaves every requested scope unchanged; add or run focused tests for those cases.
Written by the indexing model from the issue text.
Description
Description
When the requested scope does not include openid, the SDK appends it, but it also lowercases every other scope in the string. Scope values are case-sensitive (RFC 6749, section 3.3), so a mixed-case API permission such as read:Messages is sent as read:messages, and the authorization server does not grant the permission that was requested.
The scopes are left untouched when openid is already present, so the result depends on whether the caller included openid.
The code path is OidcUtils.includeRequiredScope, which ParameterBuilder.setScope, Request.addParameter("scope", ...), Request.addParameters(...) and WebAuthProvider.login(...).withScope(...) all use.
Reproduction
val params = ParameterBuilder.newBuilder()
.setScope("profile read:Messages")
.asDictionary()
// Expected: "profile read:Messages openid"
// Actual: "profile read:messages openid"
println(params["scope"])
WebAuthProvider.login(account).withScope(...) goes through the same function.
Additional context
- Auth0.Android:
mainatacf4068. - Workaround: include
openidin the scope string yourself.
- Dominant language
- Kotlin
- Stars
- 301
- Forks
- 183
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 19
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from auth0/Auth0.Android
-
Difficulty 4/5 3-5 days Newbie friendliness 28/100
auth0/Auth0.Android#1093 · 5 comments ·
Maintainers usually reply within 1 day
All issues in auth0/Auth0.Android
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
commons-app/apps-android-commons#7072 ·
Maintainers usually reply within 1 day
-
bug ci good first issue help wanted severity: medium
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
dhananjay-nautiyal/music#17 · 1 comment ·
Maintainers usually reply within 1 day
-
Watch Next: last engagement time is in seconds for played items and in milliseconds for the othersOpen
Difficulty 1/5 Under an hour Newbie friendliness 79/100
damontecres/Wholphin#2112 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
beppe2880/opencode-mobile#60 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100