Small OAuth Bug

1

Hey there,

I’m not really sure which category this fits into so I’m posting this as Uncategorized.

My plan was to try and not request a scope, since I only need the user-id for my project and thought that might work without any scopes.
But when authenticating via the https://www.patreon.com/oauth2/authorize url, I caught a bug.
If the scope query param is empty (&scope=), you can still authorize and get a single use code, but validating that on the server (via the /api/oauth2/token?code=x) returns an error 500.

Not that big of a deal but it would be great if a dev could look into it.

1 Like
2

Looks like this happens specifically when scope param in the authorization flow is set to empty (&scope=). If no param was provided, then the default identity scope would’ve been set. Thanks for reporting, I’ll let you know when this is fixed.

1 Like
3

@jubewe the fix for this shipped this morning. Thanks for reporting!