{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/2426","labels_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/2426/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/2426/comments","events_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/2426/events","html_url":"https://github.com/mozilla/fxa-content-server/issues/2426","id":76541714,"number":2426,"title":"\"Invalid Scopes\" error from oauth-server does not produce error UI","user":{"login":"rfk","id":34695,"avatar_url":"https://avatars.githubusercontent.com/u/34695?v=3","gravatar_id":"","url":"https://api.github.com/users/rfk","html_url":"https://github.com/rfk","followers_url":"https://api.github.com/users/rfk/followers","following_url":"https://api.github.com/users/rfk/following{/other_user}","gists_url":"https://api.github.com/users/rfk/gists{/gist_id}","starred_url":"https://api.github.com/users/rfk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfk/subscriptions","organizations_url":"https://api.github.com/users/rfk/orgs","repos_url":"https://api.github.com/users/rfk/repos","events_url":"https://api.github.com/users/rfk/events{/privacy}","received_events_url":"https://api.github.com/users/rfk/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/mozilla/fxa-content-server/labels/waffle:in%20progress","name":"waffle:in progress","color":"ededed"}],"state":"open","locked":false,"assignee":{"login":"shane-tomlinson","id":848085,"avatar_url":"https://avatars.githubusercontent.com/u/848085?v=3","gravatar_id":"","url":"https://api.github.com/users/shane-tomlinson","html_url":"https://github.com/shane-tomlinson","followers_url":"https://api.github.com/users/shane-tomlinson/followers","following_url":"https://api.github.com/users/shane-tomlinson/following{/other_user}","gists_url":"https://api.github.com/users/shane-tomlinson/gists{/gist_id}","starred_url":"https://api.github.com/users/shane-tomlinson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shane-tomlinson/subscriptions","organizations_url":"https://api.github.com/users/shane-tomlinson/orgs","repos_url":"https://api.github.com/users/shane-tomlinson/repos","events_url":"https://api.github.com/users/shane-tomlinson/events{/privacy}","received_events_url":"https://api.github.com/users/shane-tomlinson/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/mozilla/fxa-content-server/milestones/48","html_url":"https://github.com/mozilla/fxa-content-server/milestones/train%2038","labels_url":"https://api.github.com/repos/mozilla/fxa-content-server/milestones/48/labels","id":1044666,"number":48,"title":"train 38","description":"Train 37 - May 12-May 25","creator":{"login":"shane-tomlinson","id":848085,"avatar_url":"https://avatars.githubusercontent.com/u/848085?v=3","gravatar_id":"","url":"https://api.github.com/users/shane-tomlinson","html_url":"https://github.com/shane-tomlinson","followers_url":"https://api.github.com/users/shane-tomlinson/followers","following_url":"https://api.github.com/users/shane-tomlinson/following{/other_user}","gists_url":"https://api.github.com/users/shane-tomlinson/gists{/gist_id}","starred_url":"https://api.github.com/users/shane-tomlinson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shane-tomlinson/subscriptions","organizations_url":"https://api.github.com/users/shane-tomlinson/orgs","repos_url":"https://api.github.com/users/shane-tomlinson/repos","events_url":"https://api.github.com/users/shane-tomlinson/events{/privacy}","received_events_url":"https://api.github.com/users/shane-tomlinson/received_events","type":"User","site_admin":false},"open_issues":10,"closed_issues":1,"state":"open","created_at":"2015-03-30T12:54:05Z","updated_at":"2015-05-17T12:48:30Z","due_on":"2015-05-24T23:00:00Z","closed_at":null},"comments":1,"created_at":"2015-05-15T00:48:47Z","updated_at":"2015-05-17T16:58:08Z","closed_at":null,"body":"I found this while testing the flip over of pocket relier credentials to `trusted: false` status, while they're still requesting full `profile` scope.  STR:\r\n\r\n* Sign in through an untrusted relier\r\n* Tweak the requested scope to something that's not allowed for untrusted reliers, like \"profile\".\r\n* Enter password and click \"Sign In\"\r\n\r\nExpected Results:\r\n\r\n* An error indicator of some kind, e.g our little red box with the error message\r\n\r\nActual Results:\r\n\r\n* The page appears to hang with the \"Sign In\" button greyed out and no indication that something has gone wrong.  Network view reveals a 400 error from oauth /authorization request."},"comment":{"url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/comments/102822865","html_url":"https://github.com/mozilla/fxa-content-server/issues/2426#issuecomment-102822865","issue_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/2426","id":102822865,"user":{"login":"shane-tomlinson","id":848085,"avatar_url":"https://avatars.githubusercontent.com/u/848085?v=3","gravatar_id":"","url":"https://api.github.com/users/shane-tomlinson","html_url":"https://github.com/shane-tomlinson","followers_url":"https://api.github.com/users/shane-tomlinson/followers","following_url":"https://api.github.com/users/shane-tomlinson/following{/other_user}","gists_url":"https://api.github.com/users/shane-tomlinson/gists{/gist_id}","starred_url":"https://api.github.com/users/shane-tomlinson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shane-tomlinson/subscriptions","organizations_url":"https://api.github.com/users/shane-tomlinson/orgs","repos_url":"https://api.github.com/users/shane-tomlinson/repos","events_url":"https://api.github.com/users/shane-tomlinson/events{/privacy}","received_events_url":"https://api.github.com/users/shane-tomlinson/received_events","type":"User","site_admin":false},"created_at":"2015-05-17T16:58:08Z","updated_at":"2015-05-17T16:58:08Z","body":"@rfk - I issued what I view as a partial fix in #2433. We now display an error message, but it could be displayed sooner to help relier developers.\r\n\r\nPOST /authorization must be called for the user to learn that the requested scopes are invalid. This is kinda crappy because /authorization is not called in the signin flow until after the user has clicked \"proceed\" on the permissions screen. On sign up, it's even worse. The user must verify their email before /authorization is called!\r\n\r\nA nicer flow would be for the list of acceptable scopes to be returned in the call to `/v1/client/<client_id>`. If a requested scope does not match one in the list, `Invalid scopes` could be displayed to the user on startup.\r\n"}}