Enhanced User Control in OAuth
Cloudflare introduces a new feature allowing users to make more granular permission selections in OAuth.
1A New Era for OAuth
Cloudflare revealed that thousands of third-party OAuth applications have been created on its platform since June 2023, with over a million authorizations. OAuth enables users to grant permissions to applications without sharing long-term credentials. However, in the traditional model, users had to choose between granting all permissions or none at all.
2The All-or-Nothing Problem
In the current system, when an application requested broad permissions, users had no way to limit these requests. For instance, an MCP server might theoretically require many permissions, but most users wouldn't want to grant such extensive access. This situation forced app developers to create custom permission selection screens, negatively impacting user experience.
3Optional Scope Feature
Cloudflare's new feature allows developers to mark specific permissions as optional. Users can now deselect optional permissions from an application's request on the authorization screen. Required permissions remain unchanged. This provides users with more controlled access while enhancing security across the platform.
4Authorization Flow-Specific Evaluation
In the new system, required and optional permissions are evaluated based on the specific scope set requested in each authorization flow. For example, if a client configured with four permissions only requests two, the others aren't evaluated. This approach ensures users focus only on permissions relevant to the current task.
5Developer-Side Configuration
Developers can specify which permissions should be optional when configuring an OAuth client. For instance, a client might mark workers-kv-storage.write and zone.read as optional, allowing users to reject these during authorization. The system maintains default behavior for existing OAuth clients; changes only apply when optional scopes are defined.
6Partial Authorization Compatibility
When users reject optional permissions, the generated access token only includes approved permissions. This requires developers to check the granted permission set when exchanging authorization codes. Applications that can operate with narrower permission sets enable users to authorize them more comfortably, enhancing trust.
7Product-Specific Scope Expansion
Cloudflare will expand account and zone-level role surfaces to cover nearly all products in coming weeks. This means more API token roles, account membership options, and OAuth scopes. Customers will gain tools to secure workloads with precisely the right access levels needed for their operations.
8Security Advancement
Optional OAuth scopes aim to deliver a more flexible and trustworthy authorization experience on Cloudflare. Developers can create more nuanced authorization flows while users gain greater control over access decisions. This innovation strengthens the platform's overall security posture while improving user experience.
Original article: Cloudflare Blog — OAuth'da Kullanıcı Kontrolü Artıyor