This repository has been archived by the owner on Oct 29, 2024. It is now read-only.
Align JWT scopes Encoding with OAuth 2.0 Specifications in AccessToken and RefreshToken #16
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR refines the handling of the
scopes
property within JWT payloads for bothAccessToken
andRefreshToken
structures, transitioning from an array format ([String]?
) to a singular string format (String?
). This adjustment ensures our JWT scope representation is in full compliance with the OAuth 2.0 Authorization Framework as outlined in RFC 6749.RFC 6749 specifies that scopes should be space-delimited within the scope parameter. While this standard directly pertains to OAuth 2.0 request parameters, adopting a consistent representation in JWTs promotes uniformity and simplifies integration with OAuth 2.0 compliant systems. Moreover, it enhances interoperability by ensuring scope representations are universally understood and processed in the same manner, irrespective of their context within requests or tokens.
Key Changes:
scopes
property withinAccessToken
andRefreshToken
JWTs is now a singleString?
, accommodating a space-separated list of scopes, instead of[String]?
.scopes
as a space-separated string. This includes modifications to serialization methods and adjustments to parsing routines to split the string into individual scopes when necessary.This change does not affect the OAuth 2.0 request or response formats directly but rather aligns the JWT payload structure with the broader expectations of the OAuth 2.0 framework, facilitating a more standardized approach to scope handling across different components of the authentication and authorization flow.