Managing User Consent and Scopes

In this lesson, you will learn how to design transparent consent screens that authorize your application to access specific user data via requested scopes.

Understanding Scopes and Consent

When an application requests access to a user's resources (like their email or calendar), it doesn't request "everything." Instead, it requests specific scopes—granular permissions that define exactly what the app can do. The consent screen is the bridge between your application's intent and the user’s approval.

In a modern OIDC flow, when your C# application sends a request to an Identity Server, the scope parameter is the most critical piece. If you request openid profile email offline_access, the Identity Server triggers a consent prompt, asking the user: "Do you allow this application to view your profile, email, and receive a refresh token?"

Implementing the Consent Model

Rather than automatically granting access, you must ensure the identity provider presents a clear UI. In ASP.NET Core with IdentityServer, the consent screen is essentially an MVC or Razor Page that processes a ConsentInputModel.

Here is a simplified view of how you capture that decision:

[HttpPost]
public async Task<IActionResult> Index(ConsentInputModel model)
{
    // 1. Fetch the request details from the IdentityServer
    var request = await _interaction.GetAuthorizationContextAsync(model.ReturnUrl);

    if (model.Button == "no")
    {
        // User denied access
        await _interaction.GrantConsentAsync(request, ConsentResponse.Denied());
    }
    else if (model.Button == "yes" && model.ScopesConsented != null)
    {
        // User granted specific scopes
        var result = new ConsentResponse { ScopesConsented = model.ScopesConsented };
        await _interaction.GrantConsentAsync(request, result);
    }
    
    return Redirect(model.ReturnUrl);
}

Best Practices for Consent UX

1. Be Granular: Never request all_access if you only need read_profile. Users are more likely to grant permission if the scopes match the functionality.
2. Explain "Why": On your consent page, display a clear explanation of why the application needs each scope.
3. Persistence: Remember that after the user consents, you store that decision so they aren't prompted every single time the token expires (unless they revoke access).

Key Takeaway: Consent screens transform abstract technical scopes into meaningful user choices, building trust by providing granular control over data access.