Device Code Flow (OAuth 2.0 Device Authorization Grant)
Was ist Device Code Flow (OAuth 2.0 Device Authorization Grant)?
Device Code Flow (OAuth 2.0 Device Authorization Grant)An OAuth 2.0 grant (RFC 8628) where an input-constrained device (smart TV, CLI, IoT device) shows the user a code and a verification URL to authenticate on a second device — convenient for CLIs but a documented phishing vector.
The OAuth 2.0 Device Authorization Grant, specified in RFC 8628 and colloquially called the device code flow, lets a client without a usable browser (smart TVs, CLIs, kiosks, IoT devices) obtain user-delegated tokens by asking the user to authenticate on a separate device. The client requests a `device_code` and a short `user_code` from the IdP and displays the user_code plus a verification URL (e.g. `https://microsoft.com/devicelogin`); the user opens that URL on their phone or laptop, signs in, types the user_code, and consents. The IdP issues tokens to the original device. The flow is the basis for `gh auth login`, `az login --use-device-code`, Apple TV sign-in, Roku and Google TV pairing, and many CLI tools. It is also a documented phishing vector: an attacker can initiate a device code flow against a target tenant and send the user_code in a phishing message, tricking the victim into authenticating on a legitimate IdP page that issues tokens to the attacker (see Storm-2372). Defensive controls include Conditional Access policies that restrict the device code flow to specific apps or user groups, throttling, and user education.
● Beispiele
- 01
`gh auth login` prints a short user code and a URL; the user signs in on a laptop, enters the code, and the CLI receives tokens.
- 02
An Entra ID Conditional Access policy disables the device-code flow tenant-wide except for a tightly scoped CLI-user group.
● Häufige Fragen
Was ist Device Code Flow (OAuth 2.0 Device Authorization Grant)?
An OAuth 2.0 grant (RFC 8628) where an input-constrained device (smart TV, CLI, IoT device) shows the user a code and a verification URL to authenticate on a second device — convenient for CLIs but a documented phishing vector. Es gehört zur Kategorie Identität und Zugriff der Cybersicherheit.
Was bedeutet Device Code Flow (OAuth 2.0 Device Authorization Grant)?
An OAuth 2.0 grant (RFC 8628) where an input-constrained device (smart TV, CLI, IoT device) shows the user a code and a verification URL to authenticate on a second device — convenient for CLIs but a documented phishing vector.
Wie funktioniert Device Code Flow (OAuth 2.0 Device Authorization Grant)?
The OAuth 2.0 Device Authorization Grant, specified in RFC 8628 and colloquially called the device code flow, lets a client without a usable browser (smart TVs, CLIs, kiosks, IoT devices) obtain user-delegated tokens by asking the user to authenticate on a separate device. The client requests a `device_code` and a short `user_code` from the IdP and displays the user_code plus a verification URL (e.g. `https://microsoft.com/devicelogin`); the user opens that URL on their phone or laptop, signs in, types the user_code, and consents. The IdP issues tokens to the original device. The flow is the basis for `gh auth login`, `az login --use-device-code`, Apple TV sign-in, Roku and Google TV pairing, and many CLI tools. It is also a documented phishing vector: an attacker can initiate a device code flow against a target tenant and send the user_code in a phishing message, tricking the victim into authenticating on a legitimate IdP page that issues tokens to the attacker (see Storm-2372). Defensive controls include Conditional Access policies that restrict the device code flow to specific apps or user groups, throttling, and user education.
Wie schützt man sich gegen Device Code Flow (OAuth 2.0 Device Authorization Grant)?
Schutzmaßnahmen gegen Device Code Flow (OAuth 2.0 Device Authorization Grant) kombinieren typischerweise technische Kontrollen und operative Praktiken, wie in der Definition oben beschrieben.
Welche anderen Bezeichnungen gibt es für Device Code Flow (OAuth 2.0 Device Authorization Grant)?
Übliche alternative Bezeichnungen: RFC 8628, OAuth 2.0 Device Authorization Grant.
● Verwandte Begriffe
- identity-access№ 839
OAuth 2.0
Offenes Autorisierungs-Framework, mit dem ein Ressourceninhaber einer Drittanwendung beschränkten, scoped Zugriff auf eine API gewähren kann, ohne Zugangsdaten preiszugeben.
- attacks№ 341
Device Code Phishing
An identity attack that abuses the OAuth 2.0 device authorization grant: the attacker starts a device-code flow and lures the victim into typing the resulting code on a legitimate login page, granting the attacker tokens for the victim's account.
- identity-access№ 852
OpenID Connect (OIDC)
Identitätsschicht auf Basis von OAuth 2.0, mit der Clients über signierte ID Tokens die Nutzeridentität verifizieren und Basisprofildaten abrufen können.
- identity-access№ 090
Autorisierung
Entscheidung darüber, was eine bereits authentifizierte Identität tun darf – welche Ressourcen, Aktionen und Bedingungen erlaubt sind.
- identity-access№ 1162
Single Sign-On (SSO)
Authentifizierungsverfahren, bei dem sich ein Benutzer einmalig bei einem vertrauenswürdigen Identity Provider anmeldet und anschließend mehrere Anwendungen ohne erneute Eingabe von Zugangsdaten nutzt.
- identity-access№ 928
PKCE (Proof Key for Code Exchange)
An OAuth 2.0 extension (RFC 7636) that binds an authorization-code redemption to a one-time secret created by the client, neutralizing authorization-code interception attacks on public and confidential clients alike.