6

I'd like to make a webapp that would allow users to OAuth with Stack Exchange, so that they can perform actions like voting through the app.

I'm stuck at one point, though: I know how to perform OAuth, but many users don't want to OAuth with my app if I can look in the DB and take their credentials, and possibly do bad things with them.

Is there a way to make an OAuthing webapp that doesn't allow me (the operator) to do evil things with the tokens?

  • I looked at the API. It doesnt mention anything about allowing you to vote. Are you sure voting is allowed via the API? – Daisetsu Feb 11 '14 at 21:09
  • Yes. 2.2 allows voting, closing, flagging, etc. – Undo Feb 11 '14 at 21:16
  • the API mentions that you can set the scope of the authentication request. I haven't used it personally, (but it says it acts like facebook) so it likely will tell the user which permissions you are requesting. that way you are limited by what they authorized. Does that answer the question? – Daisetsu Feb 11 '14 at 21:20
  • @Daisetsu No. Write access is write access (it can't be scoped any further), and so if they can vote they can edit and everything else. – Undo Feb 11 '14 at 21:33
1

Since the granularity of scope authorized by the StackOverflow API stops at 'write' level, it's not possible to restrict authorized privileges to only voting.

The users will simply have to trust you. They can always revoke their permission via the online app, so they could limit any damage you may do (or someone who compromises currently active tokens).

If you wanted to improve your security against attackers, you could drop tokens which haven't been used in a while (even if they're not expired) to limit any damage. The only other thing i can think of is to properly implement the secure connections when dealing with tokens.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.