CyberCertPrepWeb App FundamentalsAuthentication BasicsEASYFree question
What does the OAuth 2.0 'scope' parameter control, and why is 'minimal scope' important?
- A.Scope controls the geographic region where the token is valid
- B.Scope determines the token's expiry time
- C.Scope defines the specific permissions being requested; requesting minimal scope (only what's needed) limits damage if the token is stolen or the application is compromised - a token scoped to 'read:calendar' cannot send emails
- D.Scope is for display purposes only and has no security enforcement
Why C is correct
OAuth scopes implement least-privilege authorization. An application should request only the permissions it actually needs. 'read:profile' instead of 'admin:all'. If the application is compromised or the token stolen, a narrowly-scoped token limits what the attacker can do. Users also see the requested scopes on the consent screen, helping them make informed decisions.
Know someone studying for Web App Fundamentals? Send them this one.