Fix

src/Ocelot/Authorization/ScopesAuthorizer.cs

@@ -42,7 +42,7 @@ public Response<bool> Authorize(ClaimsPrincipal claimsPrincipal, List<string> ro
             if (routeAllowedScopes.Except(userScopes).Any())
             {
                 return new ErrorResponse<bool>(
-                    new ScopeNotAuthorizedError($"User scopes: '{string.Join(",", scopes)}' do not have all allowed route scopes: '{string.Join(",", routeAllowedScopes)}'"));
+                    new ScopeNotAuthorizedError($"User scopes: '{string.Join(",", userScopes)}' do not have all allowed route scopes: '{string.Join(",", routeAllowedScopes)}'"));
             }
 
             return new OkResponse<bool>(true);