3 ms·
The website (oauth client) has to tell the IdP (oauth provider) what level of access they want to have on the user's behalf. OIDC is an extension of oauth that
by anon84873628 4y ago
The website (oauth client) has to tell the IdP (oauth provider) what level of access they want to have on the user's behalf. OIDC is an extension of oauth that focuses on the basic identity aspects. (It basically just standardizes the user info and how to ask for it).
So an app could request only the non-data-access OIDC scope, or an IdP could enforce that it only allows apps the OIDC info.
On top of that is the user consent. What has been pointed out in threads here is that the IdPs are making the UX for basic OIDC consent too similar to the UX for consenting to privileged data access.
And of course if an oauth token is being abused, the IdP should ban the client app first, not the user...
- osigurdson 4y agoYes, I know how it works. My assertion is it really should not work this way by default. Providing identity (i.e. email address) to a random website is much different from providing them with access to sensitive data (often subtly shown in the signup dialog). It is good to take a step back from the tech and think about it from the user's perspective.