Google Cloud OAuth consent screen not reflecting changes to scope of (internal) app

user_2449750 0
Viewed 271

Background

I initially set my Google Cloud application up with the full Google Drive scope (../auth/drive) and tested the connection to my personal account (i.e. gave the app permission). I am using PyDrive FYI.

I subsequently deleted the app from my personal account (Disconnect from Drive), removed the full scope in the OAuth consent screen settings and replaced it with just the ../auth/drive.file scope.

I then deleted the OAuth credentials and recreated them (and re-downloaded them to my machine), just to be on the safe side.

Expected behaviour

When presented with the OAuth screen, I now expect the scope to reflect that the app only will have access to the files and folders it has created itself.

Actual behaviour

The OAuth consent screen still tells me the app will have access to all files and folders in my Drive.

Code I am using to authenticate

from pydrive.auth import GoogleAuth
from pydrive.drive import GoogleDrive

...

    gauth = GoogleAuth()

    gauth.LoadCredentialsFile("app_user_secrets.json")

    if gauth.credentials is None:
        gauth.GetFlow()
        gauth.flow.params.update({"access_type": "offline"})
        gauth.flow.params.update({"approval_prompt": "force"})
        gauth.LocalWebserverAuth()
    elif gauth.access_token_expired:
        gauth.Refresh()
    else:
        gauth.Authorize()

    gauth.SaveCredentialsFile("app_user_secrets.json")

    drive = GoogleDrive(gauth)

Any ideas why this is happening or how I can work around it?

google-drive-api google-oauth python
1 Answers

Turns out PyDrive sets its own OAuth scopes by default unless you overwrite them. The default is https://www.googleapis.com/auth/drive as outlined here: https://pythonhosted.org/PyDrive/oauth.html#automatic-and-custom-authentication-with-settings-yaml.

I fixed and overrode this by editing my authentication flow and including the following line before the LocalWebserverAuth() command.

gauth.settings["oauth_scope"] = ["https://www.googleapis.com/auth/drive.file"]

Another alternative would have been to author my own settings.yaml file but I did not want to go down that route.

user_24497500
Related