Cloudflare introduces task-based OAuth consent with scope customization

Enhanced OAuth Consent

Cloudflare has introduced OAuth scope customization, enabling a more granular approach to user consent for third-party applications. Previously, users faced an all-or-nothing choice when granting permissions, meaning they either approved all requested access or denied the application entirely. This new feature allows users to modify the requested permissions directly on the consent screen.

Developer and User Control

With this update, developers configuring an OAuth client can now mark specific scopes as either required or optional. During the authorization process, users are presented with the option to deselect any scopes that have been designated as optional. This provides users with greater control over the data and actions an application can access on their behalf, without requiring developers to build custom pre-consent screens.

Addressing Granularity Needs

The change addresses the increasing need for more granular permission models, especially as developers use OAuth for diverse integrations, internal tools, CLIs, and agents. While Cloudflare OAuth previously allowed clients to request a subset of configured scopes, the user experience remained binary. The new customization aligns with the OAuth specification, which permits authorization servers to grant a narrower set of scopes than initially requested.

Impact on Security and User Experience

This feature aims to give security-conscious users more flexibility in making informed choices about application access. It prevents situations where an application might request broad permissions, but a user only wishes to grant a limited subset. By allowing users to deselect optional scopes, Cloudflare enhances security by reducing the potential for over-privileged applications, while also improving the user experience by offering more control.