Scope hidding

thascoet — Wed, 17 May 2023 22:39:27 GMT

Device

Windows 10

Operating System

(iOS 10, Android Oreo, Windows 10,etc.)

My Question or Issue

Hello,

I was doing some tests with spotify api, and I've found a way to hide the scopes a user allows an application to use when you access accounts.spotify.com/authorize to get the tokens. For example, an application can ask to be able to see the user's public information, but at the end, the application gets a token to see the user's private information.

In the pictures attached, we see that the application is asking for being able to modify playlist.

But, in reality I asked for :

user-read-email
user-read-private

And so I get (I've hidden the tokens) :

even if the https://accounts.spotify.com/authorize was not showing it.

I don't know if this is already known or if it is not important, but if not you can contact me back, so I could explain to you the technical details.

Best regards.

topic Scope hidding in Spotify for Developers

Scope hidding