17

OAuth 2 device flow has an odd history. It's found in early versions of the RFC, but was then taken out seemingly without an explanation I could find. Recently, a new draft was proposed specifically to reintroduce it independently.

The device flow is suitable for clients executing on devices that do not have an easy data-entry method and where the client is incapable of receiving incoming requests from the authorization server (incapable of acting as an HTTP server).

The other flows do not cover the scenario addressed by device flow so it has utility. Google supports it and has an example of it in action. Can anyone shed any light on why device flow was dropped from the OAuth 2 standard - are there security concerns we should know about?

Improve this question
1
  • 3
    Just noticed in tools.ietf.org/html/draft-ietf-oauth-device-flow Appendix A. Acknowledgements. The -00 version of this document was based on draft-recordon-oauth- v2-device edited by David Recordon and Brent Goldman. The content of that document was initially part of the OAuth 2.0 protocol specification but was later removed due to the lack of sufficient deployment expertise at that time. We would therefore also like to thank the OAuth working group for their work on the initial content of this specification through 2010.
    – HTKLee
    Nov 23, 2016 at 9:25

1 Answer 1

Reset to default
3

I should just answer my own question after stumbling upon the reason - device flow was removed from the OAuth 2 specification:

due to lack of sufficient deployment expertise at that time

Citation from Appendix A: Acknowledgements - IETF OAuth device flow draft #01.

Device flow is fairly common place these days. Some apps (e.g. HBO GO) on media devices (e.g. Roku) appears to utilize the device flow, where the device you're logging on to is decoupled from where you're entering your credentials. E.g. when setting up the HBO GO app in Roku, I get prompted to enter a code, which I get by logging into the hbogo site from my laptop's browser.

Improve this answer
1
  • That's correct! The draft has now been published as RFC 8628.
    – William Denniss
    Aug 26, 2019 at 23:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.