Merge pull request #598 from tanguilp/fix-rfc9068-no-scope-in-jws

Fix error when RFC9068 JWS has no scope field

authlib/oauth2/rfc9068/token_validator.py

@@ -140,7 +140,7 @@ def validate_token(
         # more considerations about the relationship between scope strings and resources
         # indicated by the 'aud' claim.
 
-        if self.scope_insufficient(token['scope'], scopes):
+        if self.scope_insufficient(token.get('scope', []), scopes):
             raise InsufficientScopeError()
 
         # Many authorization servers embed authorization attributes that go beyond the