2 ms·
It is interesting though, most people use it just to avoid creating a new username/password on a random site. Usually there is no intention to grant access to a
by osigurdson 4y ago
It is interesting though, most people use it just to avoid creating a new username/password on a random site. Usually there is no intention to grant access to any data maintained on the IDP's site. I know the concept of granting such access is the whole point of OAuth but honestly seems like a rarely needed use case.
- anon84873628 4y agoThe website (oauth client) has to tell the IdP (oauth provider) what level of access they want to have on the user's behalf. OIDC is an extension of oauth that focuses on the basic identity aspects. (It basically just standardizes the user info and how to ask for it). So an app could request only the non-data-access OIDC scope, or an IdP could enforce that it only allows apps the OIDC info. On top of that is the user consent. What has been pointed out in threads here is that the IdPs are making the UX for basic OIDC consent too similar to the UX for consenting to privileged data access. And of course if an oauth token is being abused, the IdP should ban the client app first, not the user...
- osigurdson 4y agoYes, I know how it works. My assertion is it really should not work this way by default. Providing identity (i.e. email address) to a random website is much different from providing them with access to sensitive data (often subtly shown in the signup dialog). It is good to take a step back from the tech and think about it from the user's perspective.