Ocelot forwards Route when userScopes contains Any from routeAllowedScopes, but docs says that it should contains all of them

[papugamichal]

Expected Behavior / New Feature

Allowed Scopes documentation says:

If you add scopes to AllowedScopes Ocelot will get all the user claims (from the token) of the type scope and make sure that the user has all of the scopes in the list.

This is a way to restrict access to a Route on a per scope basis.

ScopesAuthoriser | Line 36

public Response<bool> Authorise(ClaimsPrincipal claimsPrincipal, List<string> routeAllowedScopes)
{
    // ...
    var matchesScopes = routeAllowedScopes.Intersect(userScopes).ToList();
    // ...
}

Example:

Token contains Scope: "A"
Defined route AllowedScopes: "A", "B"

Ocelot should reject request to be fair with documentation.

Actual Behavior / Motivation for New Feature

Example

Token contains Scope: "A".
Defined route AllowedScopes: "A", "B"

Ocelot allow to pass request, even when token do not contains all required scopes!

Change proposal

Change:
var matchesScopes = routeAllowedScopes.Intersect(userScopes).ToList();
To:
var matchesScopes = routeAllowedScopes.All(e => userScopes.Contains(e));

Or, change misleading information in documentation.

Specifications

• Version: 13.5.2, 19.0.2
• Subsystem: ASP.NET Core 2.1, .NET 7

[raman-m]

The issue has been accepted due to opened PR #1478

• #913 #1066 ScopesAuthorizer refactoring #1478