Passport: Missing default scope for oauth2-server 6.1

Created on 23 Dec 2017 · 6Comments · Source: laravel/passport

Hey there,

I just noticed, that the oauth2-server package now requires to set a default scope or explicitly define one - otherwise they will throw an exception.

See https://github.com/thephpleague/oauth2-server/releases/tag/6.1.0 and https://github.com/thephpleague/oauth2-server/pull/811.

Hope this helps! As long as this has not been done I will just use 6.0, thanks for your work!

Source

fgreinus

👍1

Most helpful comment

Or you may create token with at least one scope: https://laravel.com/docs/5.5/passport#defining-scopes

In AuthServiceProvider.php:

Laravel\Passport\Passport::tokensCan([
    'do.something' => 'Can do something',
]);

In your logic:

$token = $user->createToken('app', [
    'do.something',
]);

antonkomarev on 23 Dec 2017

👍3

All 6 comments

I've got same issue after making composer update.

$token = $user->createToken('app');

Outputs:

The requested scope is invalid, unknown, or malformed

antonkomarev on 23 Dec 2017

@a-komarev as a temp-fix you can add the following to your required packages in composer.json:
"league/oauth2-server": "6.0.*".

You may remove that as soon as passport addressed the problem.

fgreinus on 23 Dec 2017

👍1

Or you may create token with at least one scope: https://laravel.com/docs/5.5/passport#defining-scopes

In AuthServiceProvider.php:

Laravel\Passport\Passport::tokensCan([
    'do.something' => 'Can do something',
]);

In your logic:

$token = $user->createToken('app', [
    'do.something',
]);

antonkomarev on 23 Dec 2017

👍3

Hey, I've updated the package to 6.1.1 to remove the issuing of a warning for now. This should fix your problem.

As per the OAuth spec, the server should technically be issuing an invalid scope error if no scope is passed and the server doesn't have a default value set which is why this change was made originally and the release pushed a few hours back

It would be good to update Passport long term to allow us to set default scopes on the auth server but for now, I've reverted the change. If you could upgrade and let me know if this has resolved things that would be appreciated. Apologies for any inconvenience caused.

Sephster on 24 Dec 2017

👍2

@Sephster thank you. I think it's correct behavior to force server to have at least one scope. But since it wasn't implemented from the start, maybe this behavior should be changed in 7.x release?

antonkomarev on 24 Dec 2017

Closing this issue because it's already solved, old or not relevant anymore. Feel free to reply if you're still experiencing this issue.