oauth2: Rejects reqeuests with insufficient permissions

Currently, authorization requests fail when a client is being granted scopes that the client is not allowed to request - after consent. We should add an additional check that makes sure that the client isn't able to request scopes he isn't allowed to request before doing consent. We should keep the check after consent as well to make sure he wasn't accidentally granted scopes he isn't allowed to request. This patch resolves the addressed issue Closes #776
ory · May 20, 2018 · 7675144 · 7675144
1 parent fcd9180
commit 7675144
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/Gopkg.lock b/Gopkg.lock
diff --git a/Gopkg.toml b/Gopkg.toml
@@ -75,7 +75,7 @@
 
 [[constraint]]
   name = "github.com/ory/fosite"
-  version = "0.19.3"
+  version = "0.19.4"
 
 [[constraint]]
   name = "github.com/ory/graceful"