OAuth client scope handling breaks on comma-separated scope strings #3566
Description
Initial Checks
- I confirm that I'm using the newest release of my line (verified on
mainand 2.2.0) - I confirm that I searched for my issue in the issues before opening this one (searched "comma scope", "scope separator")
Release line
v2 (v1 shares the code)
Description
RFC 6749 §3.3 separates scopes with spaces, but real-world authorization servers (e.g. Linear) return comma-separated scope values in token responses and WWW-Authenticate challenges. union_scopes and the offline_access membership checks split on whitespace only, so a comma-separated grant is treated as one opaque scope: the SEP-2350 step-up union stops deduplicating (scopes accumulate as read,write read write) and offline_access/prompt=consent handling misfires.
I have a fix rebased onto current main: a parse_scopes helper accepting both separators, used in union_scopes and the offline_access membership checks, with parametrized tests. Please assign so the PR stays open.
🤖 Generated with Claude Code
Activity
maxisbey commentedon Oct 1, 2026
Thanks for the report. I'm going to close this as not planned.
As you note, RFC 6749 §3.3 defines
scopeas a space-delimited list, and a comma is a legal character inside a single scope token, so splitting on commas would mean the SDK deviating from the spec. The TypeScript, C#, Go, Rust, Swift, Ruby and PHP SDKs all split scopes on whitespace only as well.A server returning comma-separated scopes is the thing to fix here, so this is best reported to Linear directly.
AI Disclaimer