3.3. 访问令牌范围(3.3. Access Token Scope)

3.3. 访问令牌范围

授权端点和令牌端点允许客户端使用“scope”请求参数指定访问请求的范围。反过来，授权服务器使用“scope”响应参数通知客户端颁发的访问令牌的范围。

范围参数的值表示为以空格分隔，大小写敏感的字符串。 由授权服务器定义该字符串。如果该值包含多个空格分隔的字符串，他们的顺序并不重要且每个字符串为请求的范围添加一个额外的访问区域。

scope = scope-token *( SP scope-token )
scope-token = 1*( %x21 / %x23-5B / %x5D-7E )

基于授权服务器的策略或资源拥有者的指示，授权服务器可以全部或部分地忽略客户端请求的范围。如果颁发的访问令牌范围和客户端请求的范围不同，授权服务器必须包含“scope”响应参数通知客户端实际许可的范围。

在请求授权时如果客户端忽略了范围参数，授权服务器必须要么使用预定义的默认值处理请求，要么使请求失败以指出无效范围。授权服务器应该记录它的范围需求和默认值（如果已定义）。

 

3.3. Access Token Scope

   The authorization and token endpoints allow the client to specify the
   scope of the access request using the "scope" request parameter.  In
   turn, the authorization server uses the "scope" response parameter to
   inform the client of the scope of the access token issued.

   The value of the scope parameter is expressed as a list of space-
   delimited, case-sensitive strings.  The strings are defined by the
   authorization server.  If the value contains multiple space-delimited
   strings, their order does not matter, and each string adds an
   additional access range to the requested scope.

     scope       = scope-token *( SP scope-token )
     scope-token = 1*( %x21 / %x23-5B / %x5D-7E )

   The authorization server MAY fully or partially ignore the scope
   requested by the client, based on the authorization server policy or
   the resource owner's instructions.  If the issued access token scope
   is different from the one requested by the client, the authorization
   server MUST include the "scope" response parameter to inform the
   client of the actual scope granted.

   If the client omits the scope parameter when requesting
   authorization, the authorization server MUST either process the
   request using a pre-defined default value or fail the request
   indicating an invalid scope.  The authorization server SHOULD
   document its scope requirements and default value (if defined).