Re:Ask HN: Developer abused “sign in with GitHub”?
by 9wzYQbTYsAIc on Friday December 09, 2022 @08:38AM
(#33921071)
Sure, but the extra “location” and “action” objects within the proposed “authorization_details” JSON object do seem compelling when compared to just a single “scope” string.
This is not very fine-grained. It would be perfectly possible to gate access to social features of github (such as starring) behind a plain old scope. Distinguishing "access to all your own repositories" from "access to anything else on github, as you" also is not a fine-grained difference.