#0208
An OAuth 2.0 authorization server issues tokens with a set of scopes the user explicitly approved (e.g. read:profile, read:orders).
When the client later requests a new access token via token refresh or a downstream scope-check, it passes a list of requested scopes. The server must verify that every requested scope was already granted by the user.
The buggy implementation simply returns whatever the client asks for, silently granting scopes like write:orders or admin that the user never approved — a classic OAuth scope widening attack.
OAuth scope widening lets a malicious or compromised client silently escalate its own privileges. A single missing intersection check can turn a read-only token into an admin token without the user's knowledge.
filterScopes so it returns only the scopes present in both requestedScopes and grantedScopes.filterScopes(['read:profile','write:orders','admin'], ['read:profile','read:orders'])// write:orders and admin were never granted// → ['read:profile']
filterScopes(['read:profile','read:orders'], ['read:profile','read:orders'])// → ['read:profile','read:orders']
string[] containing only the intersection of the two input arrays.requestedScopes.