Beginner LevelAuthentication & Authorization
What are OAuth 2.0 Scopes and how do they restrict API access boundaries?
❓ Interview Prompt: Explain OAuth 2.0 scope parameter strings, requested vs granted scopes, and enforcing least privilege.
OAuth 2.0 Scopes (RFC 6749) specify the exact degree of access and permissions that a user authorizes a third-party application to perform on their behalf.
Key Concepts:
•
Scope Format: Space-delimited list of case-sensitive strings (e.g. 'scope="read:user write:orders delete:items"').
•
Consent Screen: During OAuth authorization, the Auth Server displays requested scopes to the user for explicit approval.
•
Granted Scopes: The Auth Server may grant a subset of requested scopes.
•
Principle of Least Privilege: Access tokens issued with restricted scopes prevent a compromised third-party app from abusing full account access.
Code Implementation Example
typescript
// Middleware verifying OAuth access token scopes
function requireScope(requiredScope: string) {
return (req: Request, res: Response, next: NextFunction) => {
const tokenScopes: string[] = req.user?.scopes || [];
if (!tokenScopes.includes(requiredScope)) {
return res.status(403).json({
error: "Insufficient Scope: Requires '" + requiredScope + "'"
});
}
next();
};
}💡Express middleware enforcing required OAuth 2.0 access token scopes.
🎯 Interview Key Takeaway
OAuth 2.0 scopes define fine-grained permission boundaries granted to third-party applications.
#OAuth 2.0#Scopes#Permissions#Least Privilege#Beginner
Back to all Authentication & Authorization Questions→