Yaak Logo
Yaak
Feedback/OAuth 2 scope should only be sent on authorize

OAuth 2 scope should only be sent on authorize

Tia Heinrich·2 days ago·#YF1064
Released to BetaBug

Currently I am not able to use OAuth 2 auth (grant type: Authorization Code) against an OpenIddict server. It looks like the root cause is because the scope is sent not only to the authorize request, but also the access token request. That request is then outright rejected by OpenIddict.

As I cannot change anything on this server, it would be great if yaak would not send the scope for the access token request, or at least give me the option to not send it there.

As per spec the scope should not be required for the access token request: https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3

Here is a link to some context to this particular issue I believe: https://stackoverflow.com/questions/75528130/openiddict-4-0-msal-js-fails-for-code-flow-pkce-due-to-sending-scopes

Windows2026.5.0

Comments (1)

Sign in to leave a comment.

Yaak BotReleased to BetaFeatured

This is now available in 2026.7.0-beta.5!

Type to search feedback...