OAuth App Scope Customization

5 posts · Aug 2020 – Sep 2024

What this trail covers

Dropbox's OAuth system allows developers to define maximum scopes for their apps. This capability has evolved to enable further customization of requested scopes during the authorization flow. Developers can now specify a subset of enabled scopes via the `/oauth2/authorize` URL, and can also use the `include_granted_scopes` parameter to incrementally add new permissions. This provides finer-grained control over app permissions, enhancing user trust and privacy by requesting only necessary scopes.

All Dropbox trails

Sep 2024Customizing scopes in the OAuth app authorization flowThis post details how developers can further customize requested OAuth scopes beyond the maximum enabled scopes by using the `scope` parameter to specify a subset of scopes and the `include_granted_scopes` parameter to incrementally add new permissions during the authorization flow. It explains how these parameters affect the granted scopes in the token payload and the implications for app developers and user privacy.
Oct 2022Using OAuth 2.0 with offline accessThis post details the implementation of offline access for Dropbox's OAuth 2.0 flow. It explains how to obtain and use refresh tokens to acquire new short-lived access tokens, enabling applications to operate long-term without requiring the user to be present. It covers the authorization endpoints for both online and offline access, the token exchange process, and the secure storage and usage of refresh tokens. It also provides tips on choosing between online and offline access, and best practices for using response types and redirect URIs.
Dec 2020PKCE: What and Why?This post introduces and explains the PKCE (Proof Key for Code Exchange) flow as a more secure alternative to the implicit OAuth flow for public clients. It details the new parameters (code_verifier, code_challenge, code_challenge_method) and outlines the step-by-step process of how PKCE enhances security by dynamically generating client secrets and correlating authorization requests with token requests. It also provides practical examples using Node.js and curl to demonstrate the implementation.
Sep 2020Migrating App Permissions and Access TokensThis post details the migration of Dropbox's OAuth system to scoped apps, introducing short-lived access tokens, PKCE, and refresh tokens. It guides developers on reviewing and deselecting unnecessary scopes, determining required scopes by listing API endpoints and their required scopes, and programmatically setting scopes via the authorization URL. It also explains how to test and update the access token type to short-lived, and how to implement refresh tokens for offline access. The post announces the upcoming retirement of long-lived tokens.
Aug 2020Now Available: Scoped apps and enhanced permissionsIntroduced granular scopes for API access, allowing developers to request specific permissions instead of fixed app types. Added support for PKCE (Proof Key for Code Exchange) for public clients and refresh tokens for enhanced security with short-lived access tokens. Existing apps are not immediately affected but can migrate to leverage these new features.
Advertisement