CyberCertPrepWeb App FundamentalsAuthentication BasicsEASYFree question
What does the OAuth 2.0 'scope' parameter control, and why is 'minimal scope' important?
- A.Scope defines the specific permissions being requested; requesting minimal scope (only what's needed) limits damage if the token is stolen or the application is compromised - a token scoped to 'read:calendar' cannot send emails
- B.Scope controls the geographic region where the token is valid
- C.Scope is for display purposes only and has no security enforcement
- D.Scope determines the token's expiry time; the OAuth state parameter prevents token expiry races, with CSRF in the redirect handled by the nonce claim instead; the resource owner password credentials grant is the current best practice for first-party mobile apps under OAuth 2.1
Why A is correct
OAuth scopes implement least-privilege authorization. An application should request only the permissions it actually needs. 'read:profile' instead of 'admin:all'. If the application is compromised or the token stolen, a narrowly-scoped token limits what the attacker can do. Users also see the requested scopes on the consent screen, helping them make informed decisions.
Know someone studying for Web App Fundamentals? Send them this one.