AuthorizationCodeApplication (and similar types) should use an ordered list of scopes

Currently, these types use an unordered Set Scope. On top of probably being unnecessary, this is also incorrect---at least according to Google's OIDC docs at https://developers.google.com/identity/openid-connect/openid-connect:

The scope parameter must begin with the openid value and then include the profile value, the email value, or both.

Indeed, the generated URL looks something like https://accounts.google.com/o/oauth2/v2/auth?client_id=<client-id>...&scope=email%20openid%20profile....

Is there any reason why a Set was chosen? It seems that on top of being incorrect it is probably also (albeit negligibly) less efficient than just a plain old List. If not I can probably put together a quick PR for this :)

To my knowledge, scopes parameter are passed as un-order list.
I meant openid profile and profile openid shall be identical to Authorization Server.
I didn't aware Google requires to begin with openid. 😮‍💨

I choose Set to avoid redundant value (in case), I meant it wont make sense to send openid profile profile.

What error you got from google with URL you mentioned above?

I have test with following auth endpoint which does not required scopes to begin with openid

https://accounts.google.com/o/oauth2/v2/auth

client_id xxx
code_challenge yyyy
code_challenge_method S256
redirect_uri http://localhost:9988/oauth2/callback
response_type code
scope https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile openid
state Google.hoauth2-demo-app-123

Free to open PR if it has to be an order list.

Well, I don't get an error, but their documentation mentions it and I think it is better to rely on that (who knows if they'll break it in the future). In any case, scopes is/should always set by the programmer, and no-one is going to type out "openid profile profile" anyways; I don't think that duplicate scopes is something worth guarding against.

Fair and I'll include in next release given this is not an block issue at this moment.

Navigation Menu

Repository navigation

AuthorizationCodeApplication (and similar types) should use an ordered list of scopes #275

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

AuthorizationCodeApplication (and similar types) should use an ordered list of scopes #275

Description

Activity

freizl commented on Aug 9, 2026

freizl commented on Aug 9, 2026

freizl commented on Aug 9, 2026

tux314159 commented on Aug 9, 2026

freizl commented on Aug 10, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions