Skip to content

Remove Youtube broad scope#87

Open
josdigital wants to merge 1 commit intodukt:developfrom
josdigital:fix-remove-unneeded-youtube-broad-scope
Open

Remove Youtube broad scope#87
josdigital wants to merge 1 commit intodukt:developfrom
josdigital:fix-remove-unneeded-youtube-broad-scope

Conversation

@josdigital
Copy link

The scope removed was asking the user permissions to manage the FULL Youtube account and that was not needed. In fact the read.only scope is more than enough to get the permission token to view the user plugin. The extra scope has been removed because when submitting a custom google app for verification, Google will complain of this large scope (and this also gives too much power to this plugin, with the risk of compromising the youtube account of the user).

Please see the permissions asked to the user:

scopes-highlight

The scope removed was asking the user permissions to manage the FULL Youtube account and that was not needed. In fact the read.only scope is more than enough to get the permission token to view the user plugin. The extra scope has been removed because when submitting a custom google app for verification, Google will complain of this large scope (and this also gives too much power to this plugin, with the risk of compromising the youtube account of the user)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant