OAuth Scope
A mechanism defined in the OAuth protocol that specifies the range of resources an application may access, determining the operations the application is permitted to perform in a user's account, such as drive, drive.readonly and drive.file.
Core Facts
Timeline (last 90 days)
OAuth scopes cannot express a semantic constraint such as "read repository files but do not scan for secrets," because they describe resource access types rather than data usage purposes.
In traditional software, the Confused Deputy Problem is mitigated through mechanisms such as CSRF Tokens and OAuth Scopes.
The OAuth 2.0 protocol is the most widely known implementation of scoped access, with authorization pages explicitly listing the permission scopes requested by an application.
All Facts (3)
The OAuth 2.0 protocol is the most widely known implementation of scoped access, with authorization pages explicitly listing the permission scopes requested by an application.
65%UnverifiedOAuth scopes cannot express a semantic constraint such as "read repository files but do not scan for secrets," because they describe resource access types rather than data usage purposes.
50%UnverifiedIn traditional software, the Confused Deputy Problem is mitigated through mechanisms such as CSRF Tokens and OAuth Scopes.
50%