I am using flask-dance to authenticate to Google's servers.
Config for flask-dance:
from flask.ext.dance.contrib.google import make_google_blueprint
google_blueprint = make_google_blueprint (
client_id=app.config['GOOGLE']['client_id'],
client_secret=app.config['GOOGLE']['client_secret'],
scope=["profile", "email"],
redirect_to="main.index",
login_url="/",
authorized_url="/authorized",
)
app.register_blueprint(google_blueprint,url_prefix="/login")
However, I am getting Warning: Scope has changed from "profile email" to "". after you go through Google's credential dialog box.
Here's the full trace:
Traceback (most recent call last):
File "/home/xxx/.virtualenvs/flask/lib/python2.7/site-packages/flask/app.py", line 1836, in __call__
return self.wsgi_app(environ, start_response)
File "/home/xxx/.virtualenvs/flask/lib/python2.7/site-packages/flask/app.py", line 1820, in wsgi_app
response = self.make_response(self.handle_exception(e))
File "/home/xxx/.virtualenvs/flask/lib/python2.7/site-packages/flask/app.py", line 1403, in handle_exception
reraise(exc_type, exc_value, tb)
File "/home/xxx/.virtualenvs/flask/lib/python2.7/site-packages/flask/app.py", line 1817, in wsgi_app
response = self.full_dispatch_request()
File "/home/xxx/.virtualenvs/flask/lib/python2.7/site-packages/flask/app.py", line 1477, in full_dispatch_request
rv = self.handle_user_exception(e)
File "/home/xxx/.virtualenvs/flask/lib/python2.7/site-packages/flask/app.py", line 1381, in handle_user_exception
reraise(exc_type, exc_value, tb)
File "/home/xxx/.virtualenvs/flask/lib/python2.7/site-packages/flask/app.py", line 1475, in full_dispatch_request
rv = self.dispatch_request()
File "/home/xxx/.virtualenvs/flask/lib/python2.7/site-packages/flask/app.py", line 1461, in dispatch_request
return self.view_functions[rule.endpoint](**req.view_args)
File "/home/xxx/.virtualenvs/flask/lib/python2.7/site-packages/flask_dance/consumer/oauth2.py", line 168, in authorized
client_secret=self.client_secret,
File "/home/xxx/.virtualenvs/flask/lib/python2.7/site-packages/requests_oauthlib/oauth2_session.py", line 199, in fetch_token
self._client.parse_request_body_response(r.text, scope=self.scope)
File "/home/xxx/.virtualenvs/flask/lib/python2.7/site-packages/oauthlib/oauth2/rfc6749/clients/base.py", line 409, in parse_request_body_response
self.token = parse_token_response(body, scope=scope)
File "/home/xxx/.virtualenvs/flask/lib/python2.7/site-packages/oauthlib/oauth2/rfc6749/parameters.py", line 376, in parse_token_response
validate_token_parameters(params)
File "/home/xxx/.virtualenvs/flask/lib/python2.7/site-packages/oauthlib/oauth2/rfc6749/parameters.py", line 406, in validate_token_parameters
raise w
Warning: Scope has changed from "profile email" to "".
On the Chrome Dev Console I get this (after the Account Chooser window right before the traceback):
GET http://localhost:5000/login/authorized?state=11rtXcAHJm0jloiDpM8IrazD9uLT3b…xnXM0ZB1DumOPqFOgu-x19CDSbDfQoKLWVEfBRTQIg.gvDk1rm330AV3oEBd8DOtNAR0Vr7lQI 500 (INTERNAL SERVER ERROR)
Navigated to http://localhost:5000/login/authorized?state=11rtXcAHJm0jloiDpM8IrazD9uLT3b…xnXM0ZB1DumOPqFOgu-x19CDSbDfQoKLWVEfBRTQIg.gvDk1rm330AV3oEBd8DOtNAR0Vr7lQI
If I do os.environ['OAUTHLIB_RELAX_TOKEN_SCOPE'] = '1' it works, but I don't think this is a solution but more of a workaround for now. :(
I opened a ticket on the issue Google OAuth2 returns no scope on authentication breaks scope test #306 on the issue.
From what I can tell from https://www.rfc-editor.org/rfc/rfc6749#section-3.3, Google isn't required to return the scope (unless the scope was changed), am I reading this correctly?
Nearest thing I can figure is there is a bug in the oauthlib plugin which I opened a bug report with already.
From the bug report, you can fix the issue by changing the file /oauth2/rfc6749/tokens.py in the plugin on Line 30 from self._new_scope = set(utils.scope_to_list(params.get('scope', ''))) to self._new_scope = set(utils.scope_to_list(params.get('scope', old_scope)))
Fix was merged: https://github.com/idan/oauthlib/pull/323