限制 OAuth 2.0 流程的范围

Question

I want to set up a OAuth 2.0 flow in my code.

I want my code, to be limited to specific scopes (even if someone accidentally writes some extra code to request additional ones).

Let's assume I want my code to be able to only access photos in facebook.

Is the only place to restrict the scope during the request to the authorisation server, eg

https://facebook.com/dialog/oauth?response_type=code&client_id=CLIENT_ID
  &redirect_uri=REDIRECT_URI&scope=email&state=1234zyx

Or is there a way to enforce this restriction when issuing client_id and client_secret so that the following request will eventually fail?

https://facebook.com/dialog/oauth?response_type=code&client_id=CLIENT_ID
  &redirect_uri=REDIRECT_URI&scope=email,posts&state=1234zyx

My use case is for google APIs btw.

Answer 1

Not enough details provided to know what you are trying to accomplish; But generally:

• The OAuth client may request any scope desired.
• The resource owner (Could be end user "consent screen" or Google if using APIs) may NOT delegate some or all requested scopes.
• The Authorization Server may ignore some or all requested scopes for many reasons.