cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Back again with another edition of 'How we use Dropbox', so find out how Ross uses Dropbox to answer some new house questions here!

Dropbox API Support & Feedback

Find help with the Dropbox API from other developers.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Re: OAuth2 empty scope does not behave correctly

OAuth2 empty scope does not behave correctly

andrewnicols
Helpful | Level 5

According to the OAuth2 Authorization documentation , the `scope` is a nullable String:

 

scope String? This parameter allows your user to authorize a subset of the scopes selected in the App Console. Multiple scopes are separated by a space. If this parameter is omitted, the authorization page will request all scopes selected on the Permissions tab. Read about scopes in the OAuth Guide.

 

This matches RFC6749 section 3.3 which states:

   If the client omits the scope parameter when requesting
   authorization, the authorization server MUST either process the
   request using a pre-defined default value or fail the request
   indicating an invalid scope.  The authorization server SHOULD
   document its scope requirements and default value (if defined).

 

However, the Dropbox API treats the nullable state incorrectly:

  • If the scope is provided, but is empty, then a 400 error message is displayed; but
  • if the scope is missing entirely then the default value is provided.

Section 3.1 of the RFC states:

   Parameters sent without a value MUST be treated as if they were
   omitted from the request.  The authorization server MUST ignore
   unrecognized request parameters.  Request and response parameters
   MUST NOT be included more than once.

It seems that the Dropbox authorization endpoint is mis-treating the value, causing the 400 error. Per the specification, a parameter with an empty value MUST be treated in the same way as an omitted parameter.

1 Accepted Solution

Accepted Solutions

Re: OAuth2 empty scope does not behave correctly

Greg-DB
Dropboxer

@andrewnicols The team has made this change and it is rolling out now. Hope this helps! 

View solution in original post

8 Replies 8

Re: OAuth2 empty scope does not behave correctly

Greg-DB
Dropboxer

Thanks for the detailed writeup! That's very helpful. I'll ask the team to update the implementation to treat an empty scope parameter the same way as a missing scope parameter.

Re: OAuth2 empty scope does not behave correctly

andrewnicols
Helpful | Level 5

Thanks for the update @Greg-DB!

 

I look forward to the change. I'll mark this as accepted once there's a response as to if/when that will be implemented.

 

Cheers

Re: OAuth2 empty scope does not behave correctly

andrewnicols
Helpful | Level 5

Hi @Greg-DB,

 

I was just wondering whether there's any update from the relevant team on the state of this and an ETA for a fix?

 

Thanks,

 

Andrew

Re: OAuth2 empty scope does not behave correctly

Greg-DB
Dropboxer

I don't have an update on this quite yet, but I'll follow up here once I do.

Re: OAuth2 empty scope does not behave correctly

andrewnicols
Helpful | Level 5

Hi @Greg-DB,

 

I'm just wondering whether you have an update to this issue yet? It's been over a month now.

 

Thanks,

 

Andrew

Re: OAuth2 empty scope does not behave correctly

Greg-DB
Dropboxer

@andrewnicols This is still open with the team, but I don't any news on this yet. I'll let you know when I do.

Re: OAuth2 empty scope does not behave correctly

Greg-DB
Dropboxer

@andrewnicols The team has made this change and it is rolling out now. Hope this helps! 

View solution in original post

Re: OAuth2 empty scope does not behave correctly

andrewnicols
Helpful | Level 5

Thanks Greg,

Much appreciated!

Need more support?