Fix dependencies

Each time the oauthlib library is changed, I have to change my code because the behaviour changes. So, can you fix the version of the libraries that you use? At least you should fix the mayor number of the dependencies since when this number changes, the API often changes.

[akshar-raaj]

In case somebody is still facing this issue, you can add os.environ[‘OAUTHLIB_RELAX_TOKEN_SCOPE’] = “1”. I am not sure if this is the best solution, but it was a quick fix which worked for me.

[benjaminwhite]

I also encounter

Warning: Scope has changed from “…” to “”.

Here’s why it occurs (at least for me):

In oauth2_session.py, fetch_token and refresh_token both call (lines 199 and 257):

self._client.parse_request_body_response(r.text, scope=self.scope)

It’s important to note that r.text does not contain details about scope.

Then in, oauthlib/oauth2/rfc6749/parameters.py, the r.text value is passed into a OAuth2Token object (375):

params = OAuth2Token(params, old_scope=scope)

The OAuth2Token searches for scope inside params (r.text’s value) but finds none, so assigns self._new_scope to an empty set:

self._new_scope = set(utils.scope_to_list(params.get('scope', '')))

validate_token_parameters is then called on the OAuth2Token which is where the trouble occurs:

if params.scope_changed:
    message = 'Scope has changed from "{old}" to "{new}".'.format(
        old=params.old_scope, new=params.scope,
    )
    scope_changed.send(message=message, old=params.old_scopes, new=params.scopes)
    if not os.environ.get('OAUTHLIB_RELAX_TOKEN_SCOPE', None):
        w = Warning(message)
        w.token = params
        w.old_scope = params.old_scopes
        w.new_scope = params.scopes
        raise w

params.scope_changed compares new_scope to old_scope, and returns true because the old_scope has a value and new_scope doesn’t.

This leads to the warning being raised.

The solution I found was to not pass scope into parse_request_body_response:

self._client.parse_request_body_response(r.text)

If you’d like, I can create a pull request.