If I'm an OAuth provider and I want to empower the user to restrict apps to only a subset of resources (for example, only resources in folder X), what is the right mechanism to do this? Scopes would seem to be it, but I find little to no precedent for this.

I often see scopes implemented as different permissions, e.g. "read-only", or "read-write". These are often very coarse categorizations, and require that if deep access is needed to any particular set of resources, it must be granted broadly as well so you end up getting read-write access to everything even if you only need to modify one thing.

Sometimes I see scopes implemented as categories of resource to access, e.g. "photos" or "email address". This only makes sense if you have a meaningful, predefined, finite set of categories of resource.

When I look at the Google Drive scopes for example, there appears to be no way to restrict an app's access to a collection of files. I apologize if I'm not looking hard enough, but this would seem to be very useful and it just doesn't exist. Drive has a "per-file" scope but that has very specific behavior that I am not interested in.

As an OAuth provider, what are the arguments for/against creating scopes for user-created resources? That is, why couldn't Google allow a scope for each of the user's folders? Presumably the app would need permission to first list the folders so that the user could select them, then the app could seek additional permissions to the folders. This would mean multiple OAuth dialogs, so I can imagine the answer is it's just hard to make a good experience. I've had a hard time finding discussion of these tradeoffs elsewhere.

1 Answer 1


You may want to alternatively consider something like a Web Powerbox instead, possibly combined with a Rumpelstiltskin tree-graph setup. OAuth basicaly has the wrong authority asking/granting paradigm to do useful multi-granular work with. With a powerbox solution, the app asks the powerbox to ask the user to select an entity that the powerbox than grants to the user. All the app thus needs is a scope for the powerbox, for example allowing the app to only ask the powerbox to ask the user to select a read-only facet of file of a specific type from the directory tree. With a Rumpelstiltskin treegraph, you can construct a directory tree with an authenticating name (password-capability) for each node without the need for relational data management (sql and stuff). Combining the two, one user of an app could delegate access to other users of the same or a related app.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .