{"action":"closed","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/17","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/17/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/17/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/17/events","html_url":"https://github.com/IdentityServer/IdentityServer4/issues/17","id":128334656,"number":17,"title":"Design of how to handle missing consent","user":{"login":"brockallen","id":649492,"avatar_url":"https://avatars.githubusercontent.com/u/649492?v=3","gravatar_id":"","url":"https://api.github.com/users/brockallen","html_url":"https://github.com/brockallen","followers_url":"https://api.github.com/users/brockallen/followers","following_url":"https://api.github.com/users/brockallen/following{/other_user}","gists_url":"https://api.github.com/users/brockallen/gists{/gist_id}","starred_url":"https://api.github.com/users/brockallen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brockallen/subscriptions","organizations_url":"https://api.github.com/users/brockallen/orgs","repos_url":"https://api.github.com/users/brockallen/repos","events_url":"https://api.github.com/users/brockallen/events{/privacy}","received_events_url":"https://api.github.com/users/brockallen/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"brockallen","id":649492,"avatar_url":"https://avatars.githubusercontent.com/u/649492?v=3","gravatar_id":"","url":"https://api.github.com/users/brockallen","html_url":"https://github.com/brockallen","followers_url":"https://api.github.com/users/brockallen/followers","following_url":"https://api.github.com/users/brockallen/following{/other_user}","gists_url":"https://api.github.com/users/brockallen/gists{/gist_id}","starred_url":"https://api.github.com/users/brockallen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brockallen/subscriptions","organizations_url":"https://api.github.com/users/brockallen/orgs","repos_url":"https://api.github.com/users/brockallen/repos","events_url":"https://api.github.com/users/brockallen/events{/privacy}","received_events_url":"https://api.github.com/users/brockallen/received_events","type":"User","site_admin":false},"milestone":null,"comments":1,"created_at":"2016-01-23T15:41:45Z","updated_at":"2016-01-23T16:57:08Z","closed_at":"2016-01-23T16:57:08Z","body":"Scenario: user is taken to consent page (code out of our control) with certain required scopes (e.g. \"openid\"). Consent response back into IdSvr does not include that scope (because of bug or lack of validation on the consent page -- whatever). \r\n\r\nBack in our \"authorization after consent\" callback page, what should we do? Do we trigger error back to client that required scopes were not granted? Do we show an error and die?\r\n\r\nSince we used to control the consent page workflow, we used to show an error to the user on the consent page that they need to agree to the required scopes, but now that's much harder to do."}}