Have we considered replacing the device_code logic with PKCE now that
PKCE exists? At the time we started this spec I'm not sure PKCE was
around, but now that it exists and is required (practically speaking)
for mobile apps, should we look at using it instead of device_code to
protect this flow?
I'm assuming that most of these devices can not protect secrets and
hence are effectively "public" clients.
If this has already been considered and I missed it, I'm sorry for the
noise :)
Thanks,
George
On 10/19/18 5:14 PM, [email protected] wrote:
A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Web Authorization Protocol WG of the IETF.
Title : OAuth 2.0 Device Flow for Browserless and Input
Constrained Devices
Authors : William Denniss
John Bradley
Michael B. Jones
Hannes Tschofenig
Filename : draft-ietf-oauth-device-flow-13.txt
Pages : 21
Date : 2018-10-19
Abstract:
This OAuth 2.0 authorization flow is designed for devices that either
lack a browser to perform a user-agent based OAuth flow, or are
input-constrained to the extent that requiring the user to input a
lot of text (like their credentials to authenticate with the
authorization server) is impractical. It enables OAuth clients on
such devices (like smart TVs, media consoles, digital picture frames,
and printers) to obtain user authorization to access protected
resources without using an on-device user-agent, provided that they
have an Internet connection.
The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-oauth-device-flow/
There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-oauth-device-flow-13
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-device-flow-13
A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-oauth-device-flow-13
Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.
Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/
_______________________________________________
OAuth mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/oauth
_______________________________________________
OAuth mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/oauth
