make scope required
@@ -1009,6 +1009,10 @@ class OAuthHandler(BaseHandler):
if not password:
missing_arguments.append('password')
+ scope = self.get_argument('scope', default=None, strip=True)
+ if not scope:
+ missing_arguments.append('scope')
+
if missing_arguments:
error_msg['error'] = constants.AccessTokenErrors.INVALID_REQUEST
error_msg['error_description'] = 'Required parameters(s) are missing: {}'\
@@ -1021,6 +1025,12 @@ class OAuthHandler(BaseHandler):
grant_type)
raise CustomHTTPError(HTTPCodes.BAD_REQUEST, message=error_msg)
+ if scope != self.AUTH_SCOPE:
+ error_msg['error'] = constants.AccessTokenErrors.INVALID_SCOPE
+ error_msg['error_description'] = 'Scope {} not supported.'.format(
+ grant_type)
+ raise CustomHTTPError(HTTPCodes.BAD_REQUEST, message=error_msg)
+
# Get the user.
try:
user_data = self.ua_client.get_user_data(username)
