⛳

My Golf Passport

OneDrive permission isolation test — version 2

Security test only — not the golf app.

No data files are uploaded, changed, or downloaded by this test. The app-folder endpoint can automatically create an empty Apps/My Golf Passport folder in your own OneDrive. The test also requests the root listing but discards the response without displaying names or contents.

Before you sign in

Confirm the browser address is https://my-golf-passport.pages.dev/ and the Microsoft consent prompt lists only basic profile access and the app folder permission. Cancel if you see access to all your files.

I understand this is an isolated permissions test, and I will check the Microsoft consent screen.

Connect to Microsoft

Registered Microsoft tenant: Configured for your organisation
Requested delegated permissions: User.Read and Files.ReadWrite.AppFolder only
Authentication: Microsoft OAuth authorisation code with PKCE; no client secret or external JavaScript libraries

Ready. Review the details before sign-in.

Results

App folder accessNot tested

Wider OneDrive root listingNot tested

Overall assessmentNot verified

We show request outcomes only — never filenames, file contents, or access tokens.

How to interpret the results

PASS requires both app-folder access to succeed and a wider root-listing request to be denied with HTTP 403. A different error is NOT VERIFIED. If the root request succeeds, the test reports FAIL and you should stop. Even PASS does not replace a security audit or check every Microsoft Graph endpoint.