Why Spring authorization server accepts null and "" as valid scopes while generating token?

Question

I have observed that spring authorization server accepts null and empty string as valid scopes and processes validations in OAuth2ClientCredentialsAuthenticationToken class. Is this valid? Also, token generation happens by default with no scopes passed in request. Is this also valid?

Thanks