{"record":{"id":"e59752e73d6e5b0e","repo":"fatedier/frp","slug":"invalid-auth-additional-scopes-optional-values-ar","errorCode":null,"errorMessage":"invalid auth additional scopes, optional values are %v","messagePattern":"invalid auth additional scopes, optional values are (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/config/v1/validation/client.go","lineNumber":105,"sourceCode":"\t}\n\tif !requirements.VirtualNet {\n\t\tfor _, cfg := range visitorCfgs {\n\t\t\tif cfg.GetBaseConfig().Plugin.Type == v1.VisitorPluginVirtualNet {\n\t\t\t\trequirements.VirtualNet = true\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t}\n\treturn requirements\n}\n\nfunc (v *ConfigValidator) validateAuthConfig(c *v1.AuthClientConfig) (Warning, error) {\n\tvar errs error\n\tif !slices.Contains(SupportedAuthMethods, c.Method) {\n\t\terrs = AppendError(errs, fmt.Errorf(\"invalid auth method, optional values are %v\", SupportedAuthMethods))\n\t}\n\tif !lo.Every(SupportedAuthAdditionalScopes, c.AdditionalScopes) {\n\t\terrs = AppendError(errs, fmt.Errorf(\"invalid auth additional scopes, optional values are %v\", SupportedAuthAdditionalScopes))\n\t}\n\n\terrs = AppendError(errs, v.validateAuthTokenSource(c.Token, c.TokenSource))\n\n\tif err := v.validateOIDCConfig(&c.OIDC); err != nil {\n\t\terrs = AppendError(errs, err)\n\t}\n\tif c.Method == v1.AuthMethodOIDC && c.OIDC.TokenSource == nil {\n\t\tif err := ValidateOIDCClientCredentialsConfig(&c.OIDC); err != nil {\n\t\t\terrs = AppendError(errs, err)\n\t\t}\n\t}\n\treturn nil, errs\n}\n\nfunc (v *ConfigValidator) validateOIDCConfig(c *v1.AuthOIDCClientConfig) error {\n\tif c.TokenSource == nil {\n\t\treturn nil","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/fatedier/frp/blob/6c8a8d0a97d03b44e9528d30b30c70cb9d61b405/pkg/config/v1/validation/client.go#L87-L123","documentation":"One or more entries in auth.additionalScopes are not recognized. The validator uses lo.Every(SupportedAuthAdditionalScopes, c.AdditionalScopes), meaning every configured scope must be a member of the supported set (e.g. \"HeartBeats\", \"NewWorkConns\"). Unknown scopes abort client startup.","triggerScenarios":"auth.additionalScopes contains a string not in SupportedAuthAdditionalScopes — e.g. \"metadata\", \"user\", or a scope name invented by analogy with other systems.","commonSituations":"Copy-pasting scope names from other auth systems; version drift where a scope was renamed; misunderstanding that scopes extend what the token authenticates (heartbeat/new-workconn messages), not generic RBAC.","solutions":["Restrict auth.additionalScopes to values listed in the error message (subset of the supported set)","Remove the additionalScopes key if not needed","Confirm scope spelling/casing against the frp version in use"],"exampleFix":"# before\n[auth]\nmethod = \"token\"\ntoken = \"t\"\nadditionalScopes = [\"HeartBeats\", \"Metadata\"]\n\n# after\n[auth]\nmethod = \"token\"\ntoken = \"t\"\nadditionalScopes = [\"HeartBeats\", \"NewWorkConns\"]","handlingStrategy":"validation","validationCode":"func validScopes(scopes []string) bool {\n    return lo.Every(validation.SupportedAuthAdditionalScopes, scopes)\n}","typeGuard":null,"tryCatchPattern":"if _, err := validation.ValidateClientCommonConfig(cfg); err != nil {\n    if strings.Contains(err.Error(), \"invalid auth additional scopes\") {\n        cfg.Auth.AdditionalScopes = nil // drop unsupported scopes, re-validate\n    }\n}","preventionTips":["Copy scope names from the frp docs of the exact version you deploy","Treat scopes as a fixed enum, not free-form"],"tags":["frp","config","auth","scopes","go"],"backgroundTag":null,"analyzedSha":"6c8a8d0a97d03b44e9528d30b30c70cb9d61b405","analyzedAt":"2026-08-15T06:53:27.215Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}