OAuth scopes are not your app's authorization model

OAuth scopes answer: "what APIs may this token call?" They do not answer: "may this user read this document?" A token with documents:read can still be used against every document ID the holder can guess, unless your API binds subject + action + resource on every request. Treat scopes as a coarse gate on the credential. Keep resource-level... Weiterlesen