Scope
In OAuth 2.0, a space-delimited list of strings in an authorization request naming the access a client is asking for. The authorization server decides what to grant, and the resulting token carries the granted scopes, which the resource server enforces.
Scopes are coarse by design and frequently misused as an authorization model. A scope says what kind of access was delegated, not which specific records the user may touch, so a token with files.read still needs the resource server to check which files belong to that user. Over-broad scopes are also what makes consent phishing effective: the user approves an application that requested far more than it needs, and the grant persists after the phishing page is gone.
See also: OAuth, access token, OAuth consent phishing, scope escalation, least privilege
Related on Start with Identity
- GlossaryAuthorization Server
In OAuth 2.0, the component that authenticates the resource owner, obtains their authorization, and issues access tokens to clients. It exposes the authorizatio
- GlossaryRefresh Token
A longer-lived credential used to obtain new access tokens without re-authenticating the user. Refresh tokens should be one-time-use (rotated on each exchange)
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- CVEOAuth 2.0 private_key_jwt audience ambiguity
A specification-level flaw in the OAuth 2.0 JWT profile: private_key_jwt audience is ambiguous, so a token minted for one authorization server can be accepted b