The user grants a permission to the client that he does not have

[springploughing]

In authorization_code mode, what happens if the client applies for a permission that the user does not have?
E.g:

1. All users have message.read, message.write and other permissions
2. The client is configured with all the permissions in 1 above
3. There is now a user Tom who only has message.read permission
4. The client uses scope=message.write to apply for authorization. At this time, Tom only has message.read, but he can successfully return the code after authorization, and the code can still be exchanged for token

[jgrandja]

Thanks for getting in touch, but it feels like this is a question that would be better suited to Stack Overflow. We prefer to use GitHub issues only for bugs and enhancements.

[springploughing]

@jgrandja Hello, I do want to enhance the existing function, because I found that when the user authorization page is authorized, it only verifies that the registered client has this permission, but in fact the user does not have this permission at all, which is equivalent to that the user grants a permission to the client that he does not have.

[jgrandja]

@litchi0509 The issue you described is a duplicate of gh-187.

Please see the following comments (gh-289, gh-139) for further context.