Consent & User Experience

In OAuth2 and OpenID Connect, user consent is when a user explicitly grants an application permission to access their protected resources or identity information.

It's a critical step that ensures users are aware of and agree to the data access an application is requesting on their behalf.

Consent is foundational for building trust between users and your application. It empowers users by giving them control over their personal data.

• Transparency: Users see exactly what data is being requested.
• Control: Users can accept or deny specific permissions.
• Compliance: Helps meet regulatory requirements like GDPR and CCPA regarding data privacy.

When an application requests access, the user is redirected to an authorization server (like Google or Facebook) which displays a consent screen.

This screen typically shows:

• The name and logo of the requesting application.
• A clear list of permissions the application wants.
• Who the authorization server is (e.g., "Sign in with Google").

The language on your consent screen must be plain and easy to understand. Avoid technical jargon or internal API names.

Instead of "https://www.googleapis.com/auth/calendar.readonly", say "View your Google Calendar events."

Be direct about the purpose of the requested access.

Whenever possible, allow users to grant specific permissions, rather than an all-or-nothing choice. This is granular consent.

For example, instead of asking for "Access to all your files," offer "Read your profile," "View your contacts," and "Edit your calendar" as separate choices.

This enhances user comfort and control.

OAuth2 uses scopes to define permissions (e.g., email, profile). While necessary internally, users don't need to see raw scopes.

Your consent screen should translate these into clear, user-centric descriptions. Explain why the app needs each permission.

• Bad: profile.write
• Good: "Modify your public profile information"

Don't overwhelm users by asking for every possible permission upfront. Employ just-in-time consent.

Request permissions only when the user is about to perform an action that requires them. For instance, ask for camera access when they tap "Take Photo," not upon app launch.

This makes the request relevant and less intrusive.

Users should always have a clear and easy way to review and revoke previously granted permissions.

This is usually done through the authorization server's settings (e.g., Google account security settings) or within the application itself, which then directs to the IdP.

Provide clear links or instructions for users to manage their consent.

A well-designed consent screen enhances user experience and trust:

• Branding: Clearly show your app's name and logo.
• Consistency: Maintain a consistent look and feel with your app.
• Clarity: Use straightforward headings and bullet points.
• Minimality: Only ask for permissions absolutely necessary for core functionality.

Which of the following are considered best practices for designing user consent screens in OAuth2/OIDC?

We've learned that user consent is vital for security and user trust in OAuth2/OIDC.

Key takeaways:

• Always ask for consent.
• Use clear, human-friendly language.
• Offer granular control and request permissions just-in-time.
• Provide a way for users to revoke consent.

These practices build a better and more secure user experience.