From b7604ffd9830dde248965170870b71662301b176 Mon Sep 17 00:00:00 2001 From: Thomas Lamant Date: Sat, 18 Apr 2026 07:57:45 +0200 Subject: [PATCH] fix(oidc): dedupe 'openid' scope in config Fixes: #516 --- src/runtime/server/lib/oauth/oidc.ts | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/runtime/server/lib/oauth/oidc.ts b/src/runtime/server/lib/oauth/oidc.ts index caa58aa3..b5d09ff6 100644 --- a/src/runtime/server/lib/oauth/oidc.ts +++ b/src/runtime/server/lib/oauth/oidc.ts @@ -243,9 +243,10 @@ interface OIDCConfiguration { */ export function defineOAuthOidcEventHandler({ config, onSuccess, onError }: OAuthConfig) { return eventHandler(async (event: H3Event) => { - config = defu(config, useRuntimeConfig(event).oauth.oidc, { - scope: ['openid'], - } satisfies OAuthOidcConfig) + config = defu(config, useRuntimeConfig(event).oauth.oidc) + if (!config.scope?.includes('openid')) { + config.scope = [...(config.scope || []), 'openid'] + } const query = getQuery<{ code?: string, error?: string, state?: string }>(event)