{"action":"closed","issue":{"url":"https://api.github.com/repos/Mashape/kong/issues/776","labels_url":"https://api.github.com/repos/Mashape/kong/issues/776/labels{/name}","comments_url":"https://api.github.com/repos/Mashape/kong/issues/776/comments","events_url":"https://api.github.com/repos/Mashape/kong/issues/776/events","html_url":"https://github.com/Mashape/kong/issues/776","id":120406353,"number":776,"title":"Only alphanumeric characters are allowed in OAuth2 scopes","user":{"login":"algd","id":7620427,"avatar_url":"https://avatars.githubusercontent.com/u/7620427?v=3","gravatar_id":"","url":"https://api.github.com/users/algd","html_url":"https://github.com/algd","followers_url":"https://api.github.com/users/algd/followers","following_url":"https://api.github.com/users/algd/following{/other_user}","gists_url":"https://api.github.com/users/algd/gists{/gist_id}","starred_url":"https://api.github.com/users/algd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/algd/subscriptions","organizations_url":"https://api.github.com/users/algd/orgs","repos_url":"https://api.github.com/users/algd/repos","events_url":"https://api.github.com/users/algd/events{/privacy}","received_events_url":"https://api.github.com/users/algd/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-12-04T13:56:18Z","updated_at":"2015-12-04T13:59:44Z","closed_at":"2015-12-04T13:59:44Z","body":"Scopes such as \"edit_profile\", \"add_friends\", are commonly used, but when requesting them via the token endpoint https://github.com/Mashape/kong/blob/master/kong/plugins/oauth2/access.lua#L94 it iterates only over the alphanumeric substrings, so these kind of scopes are splitted.\r\n\r\n[RFC6749](https://tools.ietf.org/html/rfc6749) describes this scope parameter:\r\n> The value of the scope parameter is expressed as a list of space-delimited, case-sensitive strings.\r\n\r\nSo the 'standard' solution would be using \"%S+\" instead of \"%w+\", but in some OAuth2 implementations we can see that comma-separated values are used too.\r\nWhat do you think about it?\r\n"}}