From all-or-nothing to task-based OAuth consent

Cloudflare is rolling out a new OAuth consent feature that lets users trim the permissions an app requests before approving it. Developers can now mark certain scopes as optional, so on the consent screen users can deselect the ones they don't want — while required scopes stay locked. The company says the change builds on the OAuth spec's existing flexibility, and existing apps keep their current behavior unless they opt in. Cloudflare notes that apps should check the granted scope set after authorization, since a token will only carry the scopes the user actually approved.

Listen to this story

Hear this and more stories in a personalized audio briefing.

Open The Chonkerton