Sign in with Google: how OAuth lets an app in without your password
OAuth scopes: what the consent screen of Sign in with Google really asks
Before an app gets anything from your Google account, Google shows you a short list. What each line of the OAuth consent screen means, and who your answer really goes to.
-
1
Before Google sends you back to the app, it shows you one more page: the app's name, and a short list of what it wants to do with your account. This page is the consent screen.
-
2
The list comes from the app. When it sent you to Google, it named each thing it wants, and each one is called a scope.
-
3
Google cuts your account into many small scopes. Seeing your calendar is one, changing it is another, reading your email is a third. Rono's app asks only for the first.
-
4
So read that list before you tap. If some other dinner app asks to read your email, it wants more than it needs, and Cancel is right there.
-
5
For Rono's app, you tap Allow. You give your answer on Google's page, not to the app, and Google writes it down: this person lets supperclub.example see their name, email, photo and calendar, and nothing more.
-
6
Now Google has to hand the app something that opens your calendar and nothing else, and not forever. Yet the only road back to the app runs through your browser, which keeps every address it opens in its history. What can Google send?
-
Quick check
Back to the one scope you allowed.
Show the answer
No. Changing your calendar is another scope. The app did not ask for it, and you did not allow it.
-
Go further
Two names for what the consent screen does.