4 ms·

I wish SSO providers allowed users to individually decline requested scopes when logging in. It would be a PITA for developers, but if it was the norm, you wou

by MzHN 4y ago

I wish SSO providers allowed users to individually decline requested scopes when logging in. It would be a PITA for developers, but if it was the norm, you wouldn't think about it twice. The minimum scope should be a random identifier that's unique to the service provider you are logging in to.

philsnow 4y ago
I think we'll get there eventually, like how on iphone/android you can deny individual "scopes" these days. It took a long time and there were some growing pains, but now I have little worry about some sketchy app slurping all my photos from my phone.
tjoff 4y ago
You can't? Why on earth would anyone use SSO? Are we that lazy?
- epse 4y ago
  Some do, some don't. That said, I haven't said a option to reject scopes on any of the big oauth providers
- xiphias2 4y ago
  The world works by automating things. When was the last time you washed all your clothes by hand?
  - tjoff 4y ago
    Hardly an apt comparison.
thih9 4y ago
Platforms can implement that and some already have, e.g. Facebook’s auth works like this. That being said, this approach requires monitoring and enforcement; otherwise nothing prevents the developer from not allowing the user to proceed without granting some specific permissions. Facebook again seems relatively strict here, at least post- Cambridge Analytica.
devmor 4y ago
As a developer, I know exactly how I'd solve this. The callback page would tell you that you screwed up, give you a link to try again, and not let you authenticate until you offer the proper scope. I can't imagine anyone else doing much different than that outside of special cases.
- 411111111111111 4y ago
  yeah, the granted scopes are part of the id tokens, so they're visible from the requesting application. They could theoretically be hidden by encrypting the bearer_token itself (thats part of the standard already, though few seem to actually do it atm) and omitting them in the id_token, but omitting it would to my knowledge be in violation of the standard the scope mechanic would have to be reworked altogether if this feature has any chance of actually achieving the desired effect, so a scope can only be granted for n-minutes or something. But that would make a lot of good use-cases borderline impossible (i.e. the previously mentioned alternative frontends for popular pages). Its really hard without revamping the oidc standard altogether, but thats unlikely to happen as well. Good authentication/authorization is just super hard and continues to be unsolved, especially if untrusted entities are involved.

by MzHN 4y ago

philsnow 4y ago

I think we'll get there eventually, like how on iphone/android you can deny individual "scopes" these days. It took a long time and there were some growing pains, but now I have little worry about some sketchy app slurping all my photos from my phone.

tjoff 4y ago

You can't? Why on earth would anyone use SSO? Are we that lazy?

epse 4y ago
Some do, some don't. That said, I haven't said a option to reject scopes on any of the big oauth providers
xiphias2 4y ago
The world works by automating things. When was the last time you washed all your clothes by hand?
- tjoff 4y ago
  Hardly an apt comparison.

thih9 4y ago

Platforms can implement that and some already have, e.g. Facebook’s auth works like this. That being said, this approach requires monitoring and enforcement; otherwise nothing prevents the developer from not allowing the user to proceed without granting some specific permissions. Facebook again seems relatively strict here, at least post- Cambridge Analytica.

devmor 4y ago

As a developer, I know exactly how I'd solve this. The callback page would tell you that you screwed up, give you a link to try again, and not let you authenticate until you offer the proper scope. I can't imagine anyone else doing much different than that outside of special cases.

411111111111111 4y ago
yeah, the granted scopes are part of the id tokens, so they're visible from the requesting application. They could theoretically be hidden by encrypting the bearer_token itself (thats part of the standard already, though few seem to actually do it atm) and omitting them in the id_token, but omitting it would to my knowledge be in violation of the standard the scope mechanic would have to be reworked altogether if this feature has any chance of actually achieving the desired effect, so a scope can only be granted for n-minutes or something. But that would make a lot of good use-cases borderline impossible (i.e. the previously mentioned alternative frontends for popular pages). Its really hard without revamping the oidc standard altogether, but thats unlikely to happen as well. Good authentication/authorization is just super hard and continues to be unsolved, especially if untrusted entities are involved.