search

microsoft / dev-proxy

Dev Proxy is an API simulator that helps you effortlessly test your app beyond the happy path.
https://aka.ms/devproxy
MIT License
452 stars 53 forks source link

Exclude OpenId permissions from MinimalPermissionsGuidance output #816

Open garrytrinder opened 3 days ago

garrytrinder commented 3 days ago

image

When using the MinimalPermissionsGuidance plugin to check for excessive permissions, the report contains OpenId permission scopes which are included on the token which are explicitly requested by the app when asking for an access token.

We should consider adding a new configurable property called permissionsToExclude to exclude these permissions from the report. The property default should include the default profile, openid and email scopes.

waldekmastykarz commented 3 days ago

Great suggestion that'll help decrease false-positives and focus on what matters. Would it be clearer to name the property permissionsToIgnore or is permissionsToExclude clearer after all?