bshaffer/oauth2-server-php — pull request #93 by bojanz (2013-03-31 11:21:34+00:00)
Title: Add a config setting to make returning scope during implicit flow optional

The URL limit is 2083 characters (imposed by Internet Explorer).
During the implicit flow, scope is passed in the URL.
If the server uses long scope names, and the client gets granted several of those, it is easy to breach that limit.

I suggest adding an optional setting to disable scope passing through the URL,
in which case the client needs to fetch the scope through a separate API call
(in my module that is the "verify" call that is required anyway to validate that the received token belongs to the correct client, thus avoiding http://homakov.blogspot.com/2012/08/oauth2-one-accesstoken-to-rule-them-all.html)