Device Code Flow (OAuth 2.0 Device Authorization Grant)
Что такое Device Code Flow (OAuth 2.0 Device Authorization Grant)?
Device Code Flow (OAuth 2.0 Device Authorization Grant)An OAuth 2.0 grant (RFC 8628) where an input-constrained device (smart TV, CLI, IoT device) shows the user a code and a verification URL to authenticate on a second device — convenient for CLIs but a documented phishing vector.
The OAuth 2.0 Device Authorization Grant, specified in RFC 8628 and colloquially called the device code flow, lets a client without a usable browser (smart TVs, CLIs, kiosks, IoT devices) obtain user-delegated tokens by asking the user to authenticate on a separate device. The client requests a `device_code` and a short `user_code` from the IdP and displays the user_code plus a verification URL (e.g. `https://microsoft.com/devicelogin`); the user opens that URL on their phone or laptop, signs in, types the user_code, and consents. The IdP issues tokens to the original device. The flow is the basis for `gh auth login`, `az login --use-device-code`, Apple TV sign-in, Roku and Google TV pairing, and many CLI tools. It is also a documented phishing vector: an attacker can initiate a device code flow against a target tenant and send the user_code in a phishing message, tricking the victim into authenticating on a legitimate IdP page that issues tokens to the attacker (see Storm-2372). Defensive controls include Conditional Access policies that restrict the device code flow to specific apps or user groups, throttling, and user education.
● Примеры
- 01
`gh auth login` prints a short user code and a URL; the user signs in on a laptop, enters the code, and the CLI receives tokens.
- 02
An Entra ID Conditional Access policy disables the device-code flow tenant-wide except for a tightly scoped CLI-user group.
● Частые вопросы
Что такое Device Code Flow (OAuth 2.0 Device Authorization Grant)?
An OAuth 2.0 grant (RFC 8628) where an input-constrained device (smart TV, CLI, IoT device) shows the user a code and a verification URL to authenticate on a second device — convenient for CLIs but a documented phishing vector. Относится к категории Идентификация и доступ в кибербезопасности.
Что означает Device Code Flow (OAuth 2.0 Device Authorization Grant)?
An OAuth 2.0 grant (RFC 8628) where an input-constrained device (smart TV, CLI, IoT device) shows the user a code and a verification URL to authenticate on a second device — convenient for CLIs but a documented phishing vector.
Как работает Device Code Flow (OAuth 2.0 Device Authorization Grant)?
The OAuth 2.0 Device Authorization Grant, specified in RFC 8628 and colloquially called the device code flow, lets a client without a usable browser (smart TVs, CLIs, kiosks, IoT devices) obtain user-delegated tokens by asking the user to authenticate on a separate device. The client requests a `device_code` and a short `user_code` from the IdP and displays the user_code plus a verification URL (e.g. `https://microsoft.com/devicelogin`); the user opens that URL on their phone or laptop, signs in, types the user_code, and consents. The IdP issues tokens to the original device. The flow is the basis for `gh auth login`, `az login --use-device-code`, Apple TV sign-in, Roku and Google TV pairing, and many CLI tools. It is also a documented phishing vector: an attacker can initiate a device code flow against a target tenant and send the user_code in a phishing message, tricking the victim into authenticating on a legitimate IdP page that issues tokens to the attacker (see Storm-2372). Defensive controls include Conditional Access policies that restrict the device code flow to specific apps or user groups, throttling, and user education.
Как защититься от Device Code Flow (OAuth 2.0 Device Authorization Grant)?
Защита от Device Code Flow (OAuth 2.0 Device Authorization Grant) обычно сочетает технические меры и операционные практики, как описано в определении выше.
Какие есть другие названия Device Code Flow (OAuth 2.0 Device Authorization Grant)?
Распространённые альтернативные названия: RFC 8628, OAuth 2.0 Device Authorization Grant.
● Связанные термины
- identity-access№ 839
OAuth 2.0
Открытый фреймворк авторизации, позволяющий владельцу ресурса предоставлять стороннему приложению ограниченный и регулируемый доступ к API без передачи учётных данных.
- attacks№ 341
Device Code Phishing
An identity attack that abuses the OAuth 2.0 device authorization grant: the attacker starts a device-code flow and lures the victim into typing the resulting code on a legitimate login page, granting the attacker tokens for the victim's account.
- identity-access№ 852
OpenID Connect (OIDC)
Слой идентификации поверх OAuth 2.0, позволяющий клиентам проверять подлинность пользователя и получать базовые сведения о профиле через подписанные ID-токены.
- identity-access№ 090
Авторизация
Процесс определения того, что разрешено уже аутентифицированной идентичности: к каким ресурсам, действиям и при каких условиях.
- identity-access№ 1162
Единый вход (SSO)
Способ аутентификации, при котором пользователь один раз входит у доверенного поставщика идентификации и затем получает доступ ко многим приложениям без повторного ввода учётных данных.
- identity-access№ 928
PKCE (Proof Key for Code Exchange)
An OAuth 2.0 extension (RFC 7636) that binds an authorization-code redemption to a one-time secret created by the client, neutralizing authorization-code interception attacks on public and confidential clients alike.