OAuth2 empty scope does not behave correctly

According to the OAuth2 Authorization documentation , the `scope` is a nullable String:

 

scope String? This parameter allows your user to authorize a subset of the scopes selected in the App Console. Multiple scopes are separated by a space. If this parameter is omitted, the authorization page will request all scopes selected on the Permissions tab. Read about scopes in the OAuth Guide.

 

This matches RFC6749 section 3.3 which states:

   If the client omits the scope parameter when requesting
   authorization, the authorization server MUST either process the
   request using a pre-defined default value or fail the request
   indicating an invalid scope.  The authorization server SHOULD
   document its scope requirements and default value (if defined).

 

However, the Dropbox API treats the nullable state incorrectly:

• If the scope is provided, but is empty, then a 400 error message is displayed; but
• if the scope is missing entirely then the default value is provided.

Section 3.1 of the RFC states:

   Parameters sent without a value MUST be treated as if they were
   omitted from the request.  The authorization server MUST ignore
   unrecognized request parameters.  Request and response parameters
   MUST NOT be included more than once.

It seems that the Dropbox authorization endpoint is mis-treating the value, causing the 400 error. Per the specification, a parameter with an empty value MUST be treated in the same way as an omitted parameter.