authgear-server icon indicating copy to clipboard operation
authgear-server copied to clipboard

Published 20 hours ago • verified publisher icon authgear

[App2App] Scopes should be validated according to client type

Open tung2744 opened this issue 8 months ago • 1 comments

Assume AppA is authenticated, and AppB is not authenticated.

Currently, when appB tries to authenticated with app2app by AppA, the scopes of AppA's session will be inherited to appB's session. Therefore, say if AppA supports a scope that AppB doesn't support, that new AppB's session will get an incorrect scope.

tung2744 avatar Jun 18 '24 07:06 tung2744