Skip to content

Commit fc6eb77

Browse files
BobbyHoBobbyHo
committed
docs: scope the OAuth2 refresh limitation to narrowing
The Limitations bullet listed the refreshed token keeping its original scope as a limitation, which RFC 6749 section 6 mandates and the Scopes section already states as expected behavior. State only the part that is limited: the client cannot narrow on refresh.
1 parent da5b590 commit fc6eb77

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

‎docs/admin/integrations/oauth2-provider.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -439,7 +439,7 @@ Public clients (`token_endpoint_auth_method: none`) additionally cannot register
439439
As an experimental feature, the current implementation has limitations:
440440

441441
- A scope allowlist can only be declared at [Dynamic Client Registration](#dynamic-client-registration); applications created through the web UI or the management API cannot restrict which scopes a client may request
442-
- A `scope` parameter on a refresh request is ignored, and the refreshed token keeps the scope originally granted
442+
- A client cannot narrow the token's scope on refresh; the `scope` parameter is ignored and the refreshed token always keeps the scope originally granted
443443
- No client credentials grant support
444444
- Implicit grant (`response_type=token`) is not supported; OAuth 2.1
445445
deprecated this flow due to token leakage risks, and requests return

0 commit comments

Comments
 (0)