A User-Centric Approach to API Delegations Enforcing Privacy Policies on OAuth Delegations

Abstract

OAuth is the most commonly used access delegation protocol. It enables the connection of different APIs to build increasingly sophisticated applications that enhance and amplify our abilities. Increasingly, OAuth is used in applications where a significant amount of personal data is exposed about users. Despite this privacy risk, in most OAuth flows that a user encounters, there is a lack of fine-grained control over the amount of data that is shared on behalf of users. To mitigate these privacy issues we design and implement utAPIa, a middleware which enforces privacy policies on OAuth delegations. utAPIa allows users to modify API responses that are made on their behalf by filtering unrelated attributes and protecting their sensitive information. To enforce privacy policies, utAPIa uses OAuth's standardized Rich Authorization Requests (RAR) extension, requiring no modifications to the existing OAuth protocol. We evaluate utAPIa in a proof-of-concept implementation and show the feasibility of our design, which incurs a reasonable performance overhead.