Open MarketFit opened 10 years ago
Hi Alan --
Yeah, we definitely have to work with Auth0 on a bunch of things. We do need profile access to suck in people's avatar, I believe.
And, we actually DO want as much information as people are willing to give us, since it means people don't need to re-type information in.
Twitter doesn't have much -- just bio, avatar, a link, and a location.
Good point about needing to suck in the avatar (and potentially other info).
Still, the current request is for far more info than is required. And the approval is to give Auth0 (not WeAreYVR) the permission. Users may not know Auth0, and won’t know whether to trust Auth0 to not abuse the permission.
So keeping the requested permissions to the minimum necessary is probably the best approach — subject to API granularity.
Alan
On 2014-Jun-27, at 10:19 AM, Boris Mann notifications@github.com wrote:
Hi Alan --
Yeah, we definitely have to work with Auth0 on a bunch of things. We do need profile access to suck in people's avatar, I believe.
And, we actually DO want as much information as people are willing to give us, since it means people don't need to re-type information in.
Twitter doesn't have much -- just bio, avatar, a link, and a location.
— Reply to this email directly or view it on GitHub.
The call to Auth0 currently is:
This results in Auth0 requesting access to users' Tweets and Twitter followers, LinkedIn Profile information, and Google+ personal data. This is far more information than is required to support simple authentication. This request for additional data may lead users not to proceed, as they may not want Auth0 (or WeAreYVR) to have access to their personal data.
Fortunately, it looks as if we can request authentication only, without personal data access.
According to the Auth0 Docs, the following Scope parameters are available:
It looks like if we use the default
scope: 'openid':
rather than the currentscope: 'openid profile':
then we might get simple authentication rather than personal profile access. Worth testing to be sure...