missing-scopes error handler seems not to be fully compatible with The OAuth 2.0 standard.
The information about insufficient scope should be passed in WWW-Authenticate response header with auth-scheme name followed by scope, error and error_description properties (as stated here: https://tools.ietf.org/html/rfc6750#section-3 and the following sections of the standard).
Added label enhancement as it should lead to removal of the message from the response body and as a result breaking change.
missing-scopeserror handler seems not to be fully compatible with The OAuth 2.0 standard.The information about insufficient scope should be passed in
WWW-Authenticateresponse header with auth-scheme name followed byscope,erroranderror_descriptionproperties (as stated here: https://tools.ietf.org/html/rfc6750#section-3 and the following sections of the standard).Added label
enhancementas it should lead to removal of the message from the response body and as a result breaking change.