Below is my curl. I am firing /oauth2/token endpoint in my spring boot security application. So when I give proper scopes in the request body. I am getting same scopes in response as well as in access_token.

But, the issue is when I don’t pass scopes(Either null or Empty) then I am getting by default all the scopes in response as well as in my access_token jwt.

Curl with scope:
curl –location ‘http://localhost:9000/oauth2/token’ –header ‘Content-Type: application/x-www-form-urlencoded’ –header ‘Cookie: JSESSIONID=070D5BC0E37818B02C51DC62C7F52EF8’ –data-urlencode ‘client_id=‘ –data-urlencode ‘client_secret=‘ –data-urlencode ‘grant_type=client_credentials’ –data-urlencode ‘scope=client.create’

Curl without scope:
curl –location ‘http://localhost:9000/oauth2/token’ –header ‘Content-Type: application/x-www-form-urlencoded’ –header ‘Cookie: JSESSIONID=070D5BC0E37818B02C51DC62C7F52EF8’ –data-urlencode ‘client_id=‘ –data-urlencode ‘client_secret=‘ –data-urlencode ‘grant_type=client_credentials’

I tried writing manually filter to capture request of /oauth2/token and modified it. But still this solution is not working.

My requirement :
Is there any way to configure to get scopes whatever I pass only. If null scope or empty scope is given in request. Then same should be applied to response and also in my access_token