From bc84c01b52fe5a133a7d110eaaec896d35fc684a Mon Sep 17 00:00:00 2001 From: hackerman <3372410+aeneasr@users.noreply.github.com> Date: Sun, 26 Apr 2020 10:12:05 +0200 Subject: [PATCH] docs: fix info note --- docs/docs/oauth2.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/docs/docs/oauth2.md b/docs/docs/oauth2.md index b9112bf17a9..2df262192e1 100644 --- a/docs/docs/oauth2.md +++ b/docs/docs/oauth2.md @@ -76,10 +76,14 @@ More details about the various OAuth2 flows can be found in these articles: ### OAuth 2.0 Scope != Permission -:::info The OAuth2 Scope reflects a permission the user gave to the OAuth2 +:::info + +The OAuth2 Scope reflects a permission the user gave to the OAuth2 Application, not a permission the system (e.g. API) gave to that OAuth2 application. Also, the OAuth2 Scope can not be changed without revoking the -token. ::: +token. + +::: A second important concept is the OAuth 2.0 Scope. Many people confuse OAuth 2.0 Scope with internal Access Control like for example Role Based Access Control