Merge pull request #598 from tanguilp/fix-rfc9068-no-scope-in-jws

Fix error when RFC9068 JWS has no scope field

authlib/oauth2/rfc9068/token_validator.py

@@ -140,7 +140,7 @@ def validate_token(
  # more considerations about the relationship between scope strings and resources
  # indicated by the 'aud' claim.
 
- if self.scope_insufficient(token['scope'], scopes):
+ if self.scope_insufficient(token.get('scope', []), scopes):
  raise InsufficientScopeError()
 
  # Many authorization servers embed authorization attributes that go beyond the