Scope hidding

[thascoet]

Device

Windows 10

Operating System

(iOS 10, Android Oreo, Windows 10,etc.)

My Question or Issue

Hello,

I was doing some tests with spotify api, and I've found a way to hide the scopes a user allows an application to use when you access accounts.spotify.com/authorize to get the tokens. For example, an application can ask to be able to see the user's public information, but at the end, the application gets a token to see the user's private information.

In the pictures attached, we see that the application is asking for being able to modify playlist.

But, in reality I asked for :

• user-read-email
• user-read-private

And so I get (I've hidden the tokens) :

 

even if the https://accounts.spotify.com/authorize was not showing it.

I don't know if this is already known or if it is not important, but if not you can contact me back, so I could explain to you the technical details. 

Best regards.