News for hackers. Stuff that matters.

A comment on Ask HN: Developer abused “sign in with GitHub”?. Parent comment

Re:Ask HN: Developer abused “sign in with GitHub”? by mavelikara on Friday December 09, 2022 @06:26AM (#33920161)
> This is how all oidc providers work.

No. When an app is registered with them, a provider does check if the scopes requested have a reasonable business purpose. Many registration forms even ask you to explain why you need the scopes requested. This is similar to how Apple App store does review.

Many OAuth providers also check periodically if one of their registered apps is used for any pattern of abuse.

[ Parent | on HN ]
Re:Ask HN: Developer abused “sign in with GitHub”? by 9wzYQbTYsAIc on Friday December 09, 2022 @07:02AM (#33920347)
Furthermore, a client can omit scope and leave it up to the server to decide whether to fall back to a default scope or fail the oauth request.
[ Parent | on HN ]