Limiting requested default scope to "openid" in OIDC flow. (#1082)

Azure · Dec 9, 2020 · 71b9dab · 71b9dab
1 parent d922261
commit 71b9dab
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/services/oauthService.ts b/src/services/oauthService.ts
@@ -201,7 +201,7 @@ export class OAuthService {
         const server = new AuthorizationServer();
         server.authorizationEndpoint = metadata.authorization_endpoint;
         server.tokenEndpoint = metadata.token_endpoint;
-        server.scopes = metadata.scopes_supported || ["openid"];
+        server.scopes = ["openid"];
 
         // Leaving only "implicit" grant flow until backend gets deployed.
         const supportedGrantTypes = [GrantTypes.implicit.toString(), GrantTypes.authorizationCode.toString()];