Device Code Flow (OAuth 2.0 Device Authorization Grant)
¿Qué es Device Code Flow (OAuth 2.0 Device Authorization Grant)?
Device Code Flow (OAuth 2.0 Device Authorization Grant)An OAuth 2.0 grant (RFC 8628) where an input-constrained device (smart TV, CLI, IoT device) shows the user a code and a verification URL to authenticate on a second device — convenient for CLIs but a documented phishing vector.
The OAuth 2.0 Device Authorization Grant, specified in RFC 8628 and colloquially called the device code flow, lets a client without a usable browser (smart TVs, CLIs, kiosks, IoT devices) obtain user-delegated tokens by asking the user to authenticate on a separate device. The client requests a `device_code` and a short `user_code` from the IdP and displays the user_code plus a verification URL (e.g. `https://microsoft.com/devicelogin`); the user opens that URL on their phone or laptop, signs in, types the user_code, and consents. The IdP issues tokens to the original device. The flow is the basis for `gh auth login`, `az login --use-device-code`, Apple TV sign-in, Roku and Google TV pairing, and many CLI tools. It is also a documented phishing vector: an attacker can initiate a device code flow against a target tenant and send the user_code in a phishing message, tricking the victim into authenticating on a legitimate IdP page that issues tokens to the attacker (see Storm-2372). Defensive controls include Conditional Access policies that restrict the device code flow to specific apps or user groups, throttling, and user education.
● Ejemplos
- 01
`gh auth login` prints a short user code and a URL; the user signs in on a laptop, enters the code, and the CLI receives tokens.
- 02
An Entra ID Conditional Access policy disables the device-code flow tenant-wide except for a tightly scoped CLI-user group.
● Preguntas frecuentes
¿Qué es Device Code Flow (OAuth 2.0 Device Authorization Grant)?
An OAuth 2.0 grant (RFC 8628) where an input-constrained device (smart TV, CLI, IoT device) shows the user a code and a verification URL to authenticate on a second device — convenient for CLIs but a documented phishing vector. Pertenece a la categoría de Identidad y acceso en ciberseguridad.
¿Qué significa Device Code Flow (OAuth 2.0 Device Authorization Grant)?
An OAuth 2.0 grant (RFC 8628) where an input-constrained device (smart TV, CLI, IoT device) shows the user a code and a verification URL to authenticate on a second device — convenient for CLIs but a documented phishing vector.
¿Cómo funciona Device Code Flow (OAuth 2.0 Device Authorization Grant)?
The OAuth 2.0 Device Authorization Grant, specified in RFC 8628 and colloquially called the device code flow, lets a client without a usable browser (smart TVs, CLIs, kiosks, IoT devices) obtain user-delegated tokens by asking the user to authenticate on a separate device. The client requests a `device_code` and a short `user_code` from the IdP and displays the user_code plus a verification URL (e.g. `https://microsoft.com/devicelogin`); the user opens that URL on their phone or laptop, signs in, types the user_code, and consents. The IdP issues tokens to the original device. The flow is the basis for `gh auth login`, `az login --use-device-code`, Apple TV sign-in, Roku and Google TV pairing, and many CLI tools. It is also a documented phishing vector: an attacker can initiate a device code flow against a target tenant and send the user_code in a phishing message, tricking the victim into authenticating on a legitimate IdP page that issues tokens to the attacker (see Storm-2372). Defensive controls include Conditional Access policies that restrict the device code flow to specific apps or user groups, throttling, and user education.
¿Cómo defenderse de Device Code Flow (OAuth 2.0 Device Authorization Grant)?
Las defensas contra Device Code Flow (OAuth 2.0 Device Authorization Grant) combinan habitualmente controles técnicos y prácticas operativas, como se detalla en la definición.
¿Cuáles son otros nombres para Device Code Flow (OAuth 2.0 Device Authorization Grant)?
Nombres alternativos comunes: RFC 8628, OAuth 2.0 Device Authorization Grant.
● Términos relacionados
- identity-access№ 839
OAuth 2.0
Marco abierto de autorización que permite al propietario de un recurso conceder a una aplicación de terceros acceso limitado y delimitado a una API, sin compartir credenciales.
- attacks№ 341
Device Code Phishing
An identity attack that abuses the OAuth 2.0 device authorization grant: the attacker starts a device-code flow and lures the victim into typing the resulting code on a legitimate login page, granting the attacker tokens for the victim's account.
- identity-access№ 852
OpenID Connect (OIDC)
Capa de identidad construida sobre OAuth 2.0 que permite a los clientes verificar la identidad de un usuario y obtener información de perfil mediante tokens ID firmados.
- identity-access№ 090
Autorización
Proceso que determina qué puede hacer una identidad ya autenticada: qué recursos, acciones y condiciones le están permitidos.
- identity-access№ 1162
Inicio de sesión único (SSO)
Esquema de autenticación que permite iniciar sesión una sola vez ante un proveedor de identidad de confianza y luego acceder a varias aplicaciones sin volver a introducir credenciales.
- identity-access№ 928
PKCE (Proof Key for Code Exchange)
An OAuth 2.0 extension (RFC 7636) that binds an authorization-code redemption to a one-time secret created by the client, neutralizing authorization-code interception attacks on public and confidential clients alike.