Inloggen vraagt meer dan inloggen nodig heeft
Inloggen via een andere partij geeft in dezelfde handeling toegang tot gegevens die voor het inloggen niet nodig zijn.
- Familie
- Gegevens
- Status
- actief
- Geldt voor
- web, mobile-app, api
Wat er gebeurt
Signing in through an identity provider works through an authorisation request that states what is being asked for. Authentication needs an identifier and at most a verified address. The request as sent asks for more: a contact list, a calendar, a friend list, posted content, files, profile fields the service never displays. The person sees one screen and one button, so granting the login grants the rest in the same act. What was asked is readable in the address of the authorisation request itself.
Waarom het ertoe doet
Most of what is granted here concerns other people as well: a contact list is data about people who were never asked anything. The grant usually outlives the session and often the account, it renews itself silently, and declining the extra parts while keeping the login is rarely offered.
Veelvoorkomende oorzaken
- a scope copied from an example in the provider's documentation
- one scope string for the whole application, including features this person never uses
- access that a removed feature needed, left in the request
- the broadest scope chosen during development so that nothing would fail
Dit is het níet
An identity check that reads a document more fully than the question required is Identity document read beyond the check. This entry is about a delegated authorisation: the extra access is granted rather than read, it concerns a live account elsewhere, and it stays granted after the sign-in is over.
Hoe je het vaststelt
Indicator
The scope of the authorisation request, readable in the address bar when the provider's screen appears, contains values granting access to records other than the person's identity, such as messages, contacts, calendar, files or posted content; and no control on that screen declines those values while still completing the sign-in. Both parts are read from the request and the screen as delivered.
Methode
network-observed
Kwaliteit van de detectie
90 van 100
De grenzen van deze bevinding
Wat dit patroon zou weerleggen
- Every value in the scope corresponds to a feature the person invoked, and the request is made at the moment they invoke it.met de hand te toetsende bevinding vervaltAsking at the moment of use is the fix, and where it is done this entry does not apply.
- The extra items can be declined individually and the sign-in completes without them.met de hand te toetsende bevinding vervalt
- The provider requires the value for authentication itself and offers no narrower one.met de hand te toetsende bevinding krijgt een ander patroonThe fault then sits with the party that defined the scope rather than with the application that had to pick one.
- The scope grants only fields the application displays back to the person immediately.met de hand te toetsende bevinding wordt zwakker
Wat dit patroon níet vaststelt
- harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
- severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
- unlawfulness; that is for a supervisory authority or a court
- intent; a fault is usually a build decision, not a plan
- absence: not finding it in one capture is not evidence that it is not there
Reproduceren
- manual
METHOD.mdno dedicated reproduction exists yet; follow the general method and the indicator above
Juridisch kader
Bepalingen
Veelgehoorde tegenwerpingen
The person consented on the provider's screen.
Consent has to be specific. One button that grants a login and a contact list at once is specific for neither, and the people in that contact list were asked nothing at all.
We request it but we do not use it.
A grant is access. What counts is what the token permits, not what this release happens to call, and the next release does not have to ask again.
The provider designed that screen.
The application chose the scope string; the screen only renders it. Narrowing it is a change in one line.
It is needed to make onboarding smooth.
Convenience is a purpose of the operator. It can be offered as a step the person takes, at the moment they want it, rather than folded into the login.
Geldt wanneer
to-processing