limit oauth scope to minimum possible: public github info for user

2023-03-13 11:40:25 -06:00 · 2023-03-13 11:40:25 -06:00 · 48b08d2aff
parent d08d593f69
commit 48b08d2aff
1 changed files with 2 additions and 1 deletions
--- a/pages/api/auth/[...nextauth].js
+++ b/pages/api/auth/[...nextauth].js
@ -142,7 +142,8 @@ export default (req, res) => NextAuth(req, res, {
    Providers.GitHub({
      clientId: process.env.GITHUB_ID,
      clientSecret: process.env.GITHUB_SECRET,
-      authorization: 'https://github.com/login/oauth/authorize?scope=read:user',
+      authorization: 'https://github.com/login/oauth/authorize',
+      scope: '', // read-only acces to public information
      profile: profile => {
        return {
          ...profile,