Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Allow only requesting the oauth scopes that an app needs

Abierto Apto para principiantes
  • ¿Algo no está bien?
#440 4 comentarios 2 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
68/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Tranquilo
Stack tecnológico
ios, objective-c
Área
authentication, mobile

Línea de trabajo

Comienza con GoogleSignIn/Sources/GIDSignInInternalOptions.m y GoogleSignIn/Sources/GIDScopes.m, especialmente con el manejo de los scopes referenciados. Confirma cómo se añaden email y profile y, después, determina dónde se puede exponer un opt-out compatible con versiones anteriores. Se considera terminado cuando el comportamiento predeterminado no cambia y el opt-out solicita únicamente los scopes de la app consumidora.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Is your feature request related to a problem you're having? Please describe.
My app needs to write new files to Google Drive, and it needs nothing else. As such, the only scope I request is https://www.googleapis.com/auth/drive.file. However, the login screen suggests that the app will be much more invasive than it is:
image

It appears that additional scopes beyond what the consuming app requests are always requested:
https://github.com/google/GoogleSignIn-iOS/blob/main/GoogleSignIn/Sources/GIDSignInInternalOptions.m#L56
https://github.com/google/GoogleSignIn-iOS/blob/main/GoogleSignIn/Sources/GIDScopes.m#L58
Specifically it looks like the email and profile scopes are always added.

My assumption is that those additional scopes are unnecessary for basic usage, but please tell me if I am incorrect.

As an additional downside, requesting extraneous scopes makes implementing Google's new granular permissions more messy and complicated.

Describe the solution you'd like
In the spirit of the principle of least privilege, it should be possible to use Google SignIn without extraneous scopes added. To do this in a backwards compatible way, the current behavior should remain the default, but it should be possible to set a flag to avoid scopes being added.

This seems like a very small change.

Describe alternatives you've considered
First, it's possible that those other scopes are necessary for all Google API usage. However, the fact that granular permissions allows rejecting them, that seems false.

Second, it's possible that consumers of Google SignIn just live with requesting extra scopes. However, that makes their apps look more invasive than they need, and thus sketchy. Further, it means that developers need to unnecessarily handle the more complicated granular permission case where you request many scopes.

Additional context
I'm happy to contribute this feature if it would be accepted.

Lenguaje dominante
Objective-C
Estrellas
751
Forks
282
Merge medio
7 d 10 h
PR fusionados (30 d)
5

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de google/GoogleSignIn-iOS

Todos los issues de google/GoogleSignIn-iOS

Issues similares

Más issues de Objective-C

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.