Empty scope when using OAuth 2.0

[jvitrifork]

Using Postman v7.29.1:

When using the Authorization tab using OAuth 2 and requesting a new access token, the 'scope' is sent with an empty string instead of being omitted when not used.

[dpoetzsch]

Still happens with 7.36.1.

Very annoying for us because we cannot use this feature as an empty string results in "Invalid scope" error for newer versions of keycloak.

[bodograumann]

In the current version 8.0.6 of postman you can define a scope to use. So I think this issue is fixed.

[lordldx]

@bodograumann I have to disagree.
OAuth2 states that a scope is optional, which means it's ok to not specify any scope. It is not ok to specify an empty scope.

So if you don't define a scope in the authorization tab, then the authorization request being sent should completely omit the scope field, instead including it with an empty value.

[dpoetzsch]

I can confirm what @lordldx said, it is still the same problem in version 8.0.7.

[meden]

Still valid with Postman 8.2.2

[AlexVigogne]

Hello,

Sadly still valid in 8.3.0 version.
I have to hack it with pre-req part for Keycloak..

So i have the only choice between :

• Use it on folder, and every request, even not necessary ones call Keycloak
• Use copy/paste on every request, and it pollutes every request pre-req parts.

[AdVetter]

Just updated to v9.0.7 and it seems to work now with an empty scope field.