Oauth scope discrepancy | Consent screen verification

[rustytim]

We're running into a strange issue, and hoping someone has run into this before.

Essentially running into a problem where oauth scopes are included in our consent screen that we are not knowingly requesting.

Here is the url our users are directed to in order to grant oauth access - note the scope param ( bigquury and adwords 😞

https://accounts.google.com/o/oauth2/auth
	?response_type=code	
	&client_id=our_client_id
	&redirect_uri=our_redirect
&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fadwords+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fbigquery
	&state=our_state
	&access_type=offline
	&prompt=consent
	&include_granted_scopes=true

 If we look at the oauth consent screen page in gcp, we again only see bigquery and adwords:

But then when a user actually navigates to the consent screen for our app, it prompts them for additional scopes( cloud-platform and bigquery.readonly 😞

We just want to remove the extra scopes, but can't seem to figure out where they are coming from and how to remove them.

[lawrencenelson]

Hi @rustytim,

Welcome to the Google Cloud Community!

The user-facing description, "see, edit, configure, and delete your google cloud data and see the email address for your google account" is connected to the https://www.googleapis.com/auth/cloud-platform  scope. Were you using this scope aside from your sensitive scopes?

As per Linda Lawton for this Stack Overflow thread, there is no way to delete the consent screen once you have created it. 

I hope this helps. Thank you. 😃

[rustytim · Accepted solution]

Hey @lawrencenelson, thanks for commenting.

Turns out this flag was the problem:

&include_granted_scopes=true

At some point I had tested our oauth and included the cloud-platform as a scope. When the include_granted_scopes is true it includes all previously requested scopes as well.