All 16 Authentication & Authorization (Identity, JWT, OAuth) questions
More in Authentication & Authorization (Identity, JWT, OAuth)
How do you implement role-based authorization using the [Authorize(Roles = "...")] attribute? How do refresh tokens work alongside short-lived access tokens, and why is this pattern used? What is the OAuth 2.0 Client Credentials flow, and when is it used instead of the Authorization Code flow? What are the security risks of storing JWTs in browser localStorage versus HttpOnly cookies? What are JWT claims, and how do you add custom claims when issuing a token? How does the OAuth 2.0 Authorization Code flow work, and why is it preferred over the deprecated Implicit flow for web applications? How do you implement policy-based authorization for more complex, custom access rules beyond simple roles? How does token revocation work with stateless JWTs, given they can't simply be 'deleted' server-side once issued? How does ASP.NET Core support multiple authentication schemes simultaneously (e.g., cookies for a web UI and JWT for an API in the same application)? How do you integrate external identity providers (Google, Microsoft Entra ID, Facebook) using OAuth/OpenID Connect in ASP.NET Core?
Advertisement
Back to results for “OAuth)”
.NET › Authentication & Authorization (Identity, JWT, OAuth)

What is the purpose of the 'scope' parameter in OAuth 2.0, and how does it implement the principle of least privilege?

Intermediate

Answer

Scopes are strings representing specific permissions an application requests (e.g., read:profile, write:orders), and the authorization server presents these to the user during consent, issuing an access token limited to exactly those granted scopes. This lets a resource server enforce fine-grained access control -- an application requesting only read:profile can never use its token to write data, even if it were compromised, limiting the blast radius of a leaked token.
// Requesting narrowly scoped access
GET /authorize?client_id=app123&scope=read:profile+read:email&response_type=code

// Resource server checks scope claim before allowing an action
if (!User.HasClaim("scope", "write:orders")) {
    return Results.Forbid();
}
Real-world example A third-party calendar integration requests only the calendar.readonly scope from Google, meaning even if that integration's token were somehow leaked, an attacker couldn't use it to delete or modify the user's calendar events.

Common follow-ups: How do you design a good scope taxonomy for a new API?;What's the difference between scopes and roles/claims?

Authentication & Authorization (Identity JWT OAuth);RESTful Web APIs & Controllers
All 16 Authentication & Authorization (Identity, JWT, OAuth) questions