Subject: [OAUTH-WG] WGLC for OAuth 2.0 Device Flow for Browserless and Input Constrained Devices

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Mon, 27 Nov 2017 08:55:25 -0500

All,

As discussed in Singapore, we are starting a WGLC for the
*draft-ietf-oauth-device-flow-07* document, starting today and ending on
December 11, 2018.
https://datatracker.ietf.org/doc/draft-ietf-oauth-device-flow/

Please, review the document and provide feedback on the list.

Regards,
 Rifaat & Hannes

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Mon, 27 Nov 2017 08:57:21 -0500

Sorry, I did not mean to drag it to December next year :)

The WGLC ends on *December 11, 2017*.

Regards,
 Rifaat

---

From: Mike Jones <[email-masked]>
Date: Thu, 30 Nov 2017 19:42:49 +0000

WGLC feedback from a Microsoft engineer using the device flow...

From: ...
Sent: Wednesday, November 29, 2017 9:16 AM
To: Mike Jones <[email-masked]>
Cc: ...
Subject: RE: [OAUTH-WG] WGLC for OAuth 2.0 Device Flow for Browserless and Input Constrained Devices

Hi Mike,

I got some comments around the user_code and its expiration which are not clear in the specs.

The user_code is not a one time use right? It seems to me that the user should be able to use the code more than once until the authorization is completed. Once the authorization is successful then the user_code should not be valid anymore.

The spec isn't clear about what if the user_code expires while the client is going through the authorization flow? Again, in my mind, the user_code is valid until the authorization is successful and if it expires any time before that then we should not continue with the authorization and tell the user that the user_code has expired. And if the user finished authorization and the user_code expires BEFORE the token is redeemed, then the 'expired_token' response should be sent back from the token endpoint.

Thanks,
...

From: OAuth [mailto:[email-masked]] On Behalf Of Rifaat Shekh-Yusef
Sent: Monday, November 27, 2017 5:55 AM
To: oauth <[email-masked]<mailto:[email-masked]>>
Subject: [OAUTH-WG] WGLC for OAuth 2.0 Device Flow for Browserless and Input Constrained Devices

All,

As discussed in Singapore, we are starting a WGLC for the draft-ietf-oauth-device-flow-07 document, starting today and ending on December 11, 2017.
https://datatracker.ietf.org/doc/draft-ietf-oauth-device-flow/

Regards,
 Rifaat & Hannes