OAUTH2 Device Profile
Session Topic: OAuth 2.0 Device Profile (T5E)
Convener: Marius Scurtescu
Notes-taker(s): Andrew Wansley
Tags for the session - technology discussed/ideas considered:
Discussion notes, key understandings, outstanding questions, observations, and, if appropriate to this discussion: action items, next steps:
What is the device profile?
- Similar to netflix pairing
- Device has a display, but no or a painful input
- Device gets a user code and device code
- Device says "go to URL and enter <user code>"
- User goes to browser, enters code at URL, sees a consent page, approves
- Device meanwhile polls AS, gets a code, refresh token
Use a QR code?
- Possible, but UX issues
- People may not have active sessions on their phone, so browser might be easier
- Google ended up creating separate endpoints
- Devices poll today @FB/G, could just check once
- one URL/client_id vs generic URL and globally unique codes
- 30m user code expiry time
- Session fixation attack theoretically possible, odd UX mitigates
- Client apps could use this flow
How is it modeled?
- Devices could show the user id
- other ways of solving
- Probably refresh Recordon's spec
- 6-8, variable
- could use words