Re: [OAUTH-WG] 'Scope' parameter proposal

[Brian Eaton <[e-mail]>]

On Mon, Apr 19, 2010 at 3:17 PM, Eran Hammer-Lahav <[e-mail]> wrote:
>> The scope doesn't have to match the base URI of the resource which the
>> client tried and got the 401 from?
>
> That's a security issue we need to address (when to trust the resource server and reuse an existing token). We need to figure it out either way.

Are you sure we need to figure this out?  Is it even possible to figure it out?

I'm very skeptical of attempts to automatically determine which tokens
go with which resources.  There are no examples in the wild of people
doing this.  There have been a few proposals for techniques, all of
which have turned out to either be really complicated, or to have
fundamental security problems.  Or both.

I'd rather we didn't put stuff in the OAuth 2 spec that we aren't 100%
sure is going to work.  Ideally there should be lots of examples in
production.

I do like the idea of defining the scope parameter to be a delimited
list of otherwise opaque strings.  Several service providers have
already adopted this approach, and it seems to work reasonably well.
This would even work for the complex scope definitions that Eve and
Chase have brought up.

Defining scope to be a list of strings would also enable the "least
privilege" principal that Torsten mentioned, because once someone has
a token, there would be a well-defined way of reducing the scopes in
the token.  But it's probably too soon to actually add a "privilege
drop" call to the spec - as far as I know, no one has actually built
this yet.

Cheers,
Brian