Subject: Re: [OAUTH-WG] Device Authorization Grant Interval

From: Joseph Heenan <[email-masked]>
Date: Sun, 2 Jun 2019 09:10:11 +0100

Hi Janak,

Interestingly this came up when discussing the CIBA specification (which builds upon device authorization grant to some extent) recently: https://bitbucket.org/openid/mobile/issues/135/token-endpoint-response-when-client-polls

The thought that group came up with is that returning ‘invalid_request’ would be appropriate - ideally appropriate error_description to make it easy to understand what’s going on.

Cheers,

Joseph

> On 21 May 2019, at 06:21, Janak Amarasena <[email-masked]> wrote:
> 
> Hi all,
> 
> In the OAuth2 Device Authorization Grant, what would be an appropriate response if the client does not respect the set polling interval and keeps on polling with a lower interval?
> 
> Thank you,
> Best Regards,
> 
> Janak Amarasena
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Janak Amarasena <[email-masked]>
Date: Mon, 3 Jun 2019 22:24:45 +0530

Hi Joseph,

Thank you for the information, this what I was also thinking. It would be
nice if this can be defined in the specification itself, maybe as a
recommendation as there can be wrongly written client applications or even
if some party is trying to do a brute force attack.

Best Regards,
Janak

On Sun, Jun 2, 2019 at 1:40 PM Joseph Heenan <[email-masked]> wrote:

> Hi Janak,
>
> Interestingly this came up when discussing the CIBA specification (which
> builds upon device authorization grant to some extent) recently:
> https://bitbucket.org/openid/mobile/issues/135/token-endpoint-response-when-client-polls
>
> The thought that group came up with is that returning ‘invalid_request’
> would be appropriate - ideally appropriate error_description to make it
> easy to understand what’s going on.
>
> Cheers,
>
> Joseph
>
>
> > In the OAuth2 Device Authorization Grant, what would be an appropriate
> response if the client does not respect the set polling interval and keeps
> on polling with a lower interval?
> >
> > Thank you,
> > Best Regards,
> >
> > Janak Amarasena

---

From: Aaron Parecki <[email-masked]>
Date: Mon, 3 Jun 2019 10:04:08 -0700

Is there something wrong with using the existing error code defined for
this?

>    slow_down
>      A variant of "authorization_pending", the authorization request is
>      still pending and polling should continue, but the interval MUST
>      be increased by 5 seconds for this and all subsequent requests.

https://tools.ietf.org/html/draft-ietf-oauth-device-flow-15#section-3.5

----
Aaron Parecki
aaronparecki.com
@aaronpk <http://twitter.com/aaronpk>

---

From: William Denniss <[email-masked]>
Date: Mon, 3 Jun 2019 10:05:16 -0700

The "slow_down" error response is defined for well-meaning clients. In my
own client implementations, this has the effect of increasing the interval
used
<https://github.com/google/GTMAppAuth/blob/0a606bef46c3299609e9a6f478dd79df3c3f7dc0/Source/GTMTVAuthorizationService.m#L231-L234>
.

For a misbehaving client (one that doesn't honor "slow_down" and continues
to poll too rapidly), a hard error as previously suggested seems
appropriate.

---

From: Janak Amarasena <[email-masked]>
Date: Mon, 3 Jun 2019 22:54:03 +0530

What William said was my understanding as well.

Best Regards,
Janak

On Mon, Jun 3, 2019 at 10:35 PM William Denniss <[email-masked]> wrote:

> own client implementations, this has the effect of increasing the
> interval used