How does OAuth scope work?

How does OAuth scope work?

OAuth 2.0 scopes provide a way to limit the amount of access that is granted to an access token. For example, an access token issued to a client app may be granted READ and WRITE access to protected resources, or just READ access. You can implement your APIs to enforce any scope or combination of scopes you wish.

How does OAuth work with API?

How OAuth Works

1. Step 1 – The User Shows Intent.
2. Step 2 – The Consumer Gets Permission.
3. Step 3 – The User Is Redirected to the Service Provider.
4. Step 4 – The User Gives Permission.
5. Step 5 – The Consumer Obtains an Access Token.
6. Step 6 – The Consumer Accesses the Protected Resource.

What is a scope in OAuth?

Scope is a mechanism in OAuth 2.0 to limit an application’s access to a user’s account. An application can request one or more scopes, this information is then presented to the user in the consent screen, and the access token issued to the application will be limited to the scopes granted.

What are the four roles defined by OAuth?

OAuth 2.0 defines four roles for users and applications. The OAuth roles are resource owner, resource server, client application, and authorization server. Resource Owner. This entity can grant access to a protected resource or a service.

How to use OAuth 2.0 scopes to access resources?

For example, if you generate an access token by including the ‘Get_staff’ scope you will only be able to get staff information from the API. The above scenario works well to access resources with the same scope. For example, all resources that have ‘Get_staff’ scope can be accessed using this token.

When do you need an OAuth secured API?

In an OAuth secured API we usually make checks at three levels, and you will usually want an architecture that supports all of these: OAuth provides good solutions for the first two of these, but it plays a lesser role in the third level, whose behaviour is usually domain specific.

How to design an OAuth architecture for an API?

Rather than starting with OAuth mechanics, I first design a Claims Model. This contains data used frequently across API calls to enforce access: All of this blog’s future APIs will use the following sample claims model. This object will be used as a Claims Principal in some technology stacks:

When do you need to verify the scopes of an API?

It guarantees only that ASP.NET and ASP.NET Core validate the token. Your API needs to verify that the token used to call the API is requested with the expected claims. These claims in particular need verification: The scopes if the API is called on behalf of a user.