From 3f370498b0da19b50755e712d144e8e122fcccb7 Mon Sep 17 00:00:00 2001 From: Raphael Fakhri <153192858+RaphaelFakhri@users.noreply.github.com> Date: Wed, 21 Oct 2026 07:15:44 +0000 Subject: [PATCH 1/2] fix: keep scope case when appending the openid scope --- .../java/com/auth0/android/request/internal/OidcUtils.kt | 3 +-- .../auth0/android/authentication/ParameterBuilderTest.java | 6 ++++++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/auth0/src/main/java/com/auth0/android/request/internal/OidcUtils.kt b/auth0/src/main/java/com/auth0/android/request/internal/OidcUtils.kt index bcb22f678..705e02c8c 100644 --- a/auth0/src/main/java/com/auth0/android/request/internal/OidcUtils.kt +++ b/auth0/src/main/java/com/auth0/android/request/internal/OidcUtils.kt @@ -19,8 +19,7 @@ internal object OidcUtils { */ fun includeRequiredScope(scope: String): String { val existingScopes = scope.split(" ") - .map { it.toLowerCase(Locale.ROOT) } - return if (!existingScopes.contains(REQUIRED_SCOPE)) { + return if (existingScopes.none { it.toLowerCase(Locale.ROOT) == REQUIRED_SCOPE }) { (existingScopes + REQUIRED_SCOPE).joinToString(separator = " ").trim() } else { scope diff --git a/auth0/src/test/java/com/auth0/android/authentication/ParameterBuilderTest.java b/auth0/src/test/java/com/auth0/android/authentication/ParameterBuilderTest.java index 9f771166c..5fd0a2c91 100755 --- a/auth0/src/test/java/com/auth0/android/authentication/ParameterBuilderTest.java +++ b/auth0/src/test/java/com/auth0/android/authentication/ParameterBuilderTest.java @@ -68,6 +68,12 @@ public void shouldSetRefreshToken() { assertThat(parameters, hasEntry("refresh_token", DEVICE)); } + @Test + public void shouldKeepScopeCaseWhenAddingRequiredScope() { + Map parameters = builder.setScope("profile read:Messages").asDictionary(); + assertThat(parameters, hasEntry("scope", "profile read:Messages openid")); + } + @Test public void shouldSetScopeWithOfflineAccess() { Map parameters = builder.setScope(ParameterBuilder.SCOPE_OFFLINE_ACCESS).asDictionary(); From 65bea0d8b52c43a808e0820a42cd24016f1142d3 Mon Sep 17 00:00:00 2001 From: Raphael Fakhri <153192858+RaphaelFakhri@users.noreply.github.com> Date: Thu, 22 Oct 2026 13:03:46 +0000 Subject: [PATCH 2/2] fix: match openid scope case-sensitively --- .../java/com/auth0/android/request/internal/OidcUtils.kt | 4 +--- .../auth0/android/authentication/ParameterBuilderTest.java | 6 ++++++ 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/auth0/src/main/java/com/auth0/android/request/internal/OidcUtils.kt b/auth0/src/main/java/com/auth0/android/request/internal/OidcUtils.kt index 705e02c8c..c7abfce9b 100644 --- a/auth0/src/main/java/com/auth0/android/request/internal/OidcUtils.kt +++ b/auth0/src/main/java/com/auth0/android/request/internal/OidcUtils.kt @@ -1,7 +1,5 @@ package com.auth0.android.request.internal -import java.util.* - /** * Small utility class to handle OpenID Connect conformance */ @@ -19,7 +17,7 @@ internal object OidcUtils { */ fun includeRequiredScope(scope: String): String { val existingScopes = scope.split(" ") - return if (existingScopes.none { it.toLowerCase(Locale.ROOT) == REQUIRED_SCOPE }) { + return if (existingScopes.none { it == REQUIRED_SCOPE }) { (existingScopes + REQUIRED_SCOPE).joinToString(separator = " ").trim() } else { scope diff --git a/auth0/src/test/java/com/auth0/android/authentication/ParameterBuilderTest.java b/auth0/src/test/java/com/auth0/android/authentication/ParameterBuilderTest.java index 5fd0a2c91..d36da9438 100755 --- a/auth0/src/test/java/com/auth0/android/authentication/ParameterBuilderTest.java +++ b/auth0/src/test/java/com/auth0/android/authentication/ParameterBuilderTest.java @@ -74,6 +74,12 @@ public void shouldKeepScopeCaseWhenAddingRequiredScope() { assertThat(parameters, hasEntry("scope", "profile read:Messages openid")); } + @Test + public void shouldAddRequiredScopeWhenOnlyAnotherCaseIsPresent() { + Map parameters = builder.setScope("OpenID profile").asDictionary(); + assertThat(parameters, hasEntry("scope", "OpenID profile openid")); + } + @Test public void shouldSetScopeWithOfflineAccess() { Map parameters = builder.setScope(ParameterBuilder.SCOPE_OFFLINE_ACCESS).asDictionary();