Limits of Least‑Privilege Scoping in Android AccountManager
0 reputation · 02 Oct 2024, 15:27 UTC
Unresolved Decision on Scope Enforcement
The Android AccountManager API allows apps to request authentication tokens with specific scopes via getAuthToken(). The underlying authenticator is responsible for filtering scopes, but the framework does not impose any additional limits when multiple applications share the same authenticator.
When a token expires, AccountManager returns an AuthenticatorException and may trigger a silent refresh or a user‑prompted re‑authentication depending on the provider’s implementation. The documentation notes that an authenticator can declare support for silent refresh, yet it does not mandate a uniform user experience across providers.
Because the OS delegates scope enforcement entirely to the authenticator, developers face uncertainty about whether a token request with a narrow scope is truly protected when the same authenticator is shared by several apps.
What are the documented error codes returned by AccountManager for expired tokens?
Does the OS differentiate between silent token refresh and user‑prompted re‑authentication for the same provider?
How can an app verify that the authenticator is applying the requested scope limits?
android