Is That App Trustworthy? Cloudflare Adds Shield Icons to OAuth Consent Screens!

Hi everyone, it's Shii-chan! Today I found a small but genuinely nice update in Cloudflare's Changelog, so let's take a look.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog announced an update to OAuth consent screens, the screens you see when an app asks for access to your Cloudflare account. Now, right below the screen's title, a shield icon and some explanatory text show up.

Why it matters

An OAuth consent screen is a place where you have to decide, in a split second, whether to trust an app with access to your account. But just by looking at it, it's often hard to tell whether an app is officially from Cloudflare, built by a third party, or whether that third party actually controls the domain it claims to be from. Given the risk of phishing and impersonation, being able to tell at a glance who built the app you're about to authorize matters a lot.

What changes

From now on, when you open an OAuth consent screen, a shield icon and explanatory text showing the app's identity are the first thing you see. You can check who owns the app and whether its domain ownership has been verified right there, before you grant access.

Dive Deep

There are three types of shields, each with a different meaning.

• Green filled shield: Cloudflare owns and manages the application
• Blue outlined shield: a third-party application with verified ownership of its domain
• Amber filled shield: a third-party application without verified ownership of its domain

One thing worth noting is what "verified" actually means here. According to Cloudflare, domain verification only confirms that the application owner controls the domain displayed, it doesn't vouch for the app's contents or behavior being safe. So even with a blue shield, you shouldn't let your guard down completely.

For more detail, check out the Authorizing an application documentation.

Wrap-up

• OAuth consent screens now show a shield icon and explanatory text indicating who owns the app
• There are three types: green (Cloudflare-owned), blue (third party, verified domain), and amber (third party, unverified domain)
• Domain verification only confirms domain ownership, not that the app itself is safe, so keep that in mind

This is worth knowing if you ever connect third-party apps to your Cloudflare account, or if you're an admin who cares about keeping things secure!