Protecting a RESTful API using OAuth2 with different scopes
In the previous recipe, we learned how to protect our application. In this recipe, we’ll learn how to apply more fine-grained security. We need to apply different levels of access to the application: one general form of read access for the consumers of our RESTful API and administrative access so that we can make changes to the data.
To apply different levels of access to the API, we’ll use the standard OAuth2 concept of scopes. In OAuth 2.0, scope is a parameter that’s used to specify the level of access and permissions that a client application is requesting from the user and the authorization server. It defines what actions or resources the client application is allowed to perform on behalf of the user. Scopes help ensure that users have control over which parts of their data and resources they grant access to, and they allow for fine-grained access control. In applications with user interaction...
