🐛 Bug Report: Device Code flow should not require a client secret #80

New Issue

AtHeartEngineer · 2025-07-08T08:39:12-04:00

AtHeartEngineer commented

2025-07-08 08:39:12 -04:00

Originally created by @ItalyPaleAle on 6/9/2025

Reproduction steps

When using the Device Code flow with Pocket ID, calls to the /api/oidc/device/authorize require a client_secret

Expected behavior

Per RFC 8628 sec 3.1 the device authorization request endpoint should not require a client secret. This is because clients are assumed to be public.

Section 5.6 calls this out:

Device clients are generally incapable of maintaining the confidentiality of their credentials, as users in possession of the device can reverse-engineer it and extract the credentials.

Actual Behavior

Client secret is required

Version and Environment

main branch

Log Output

No response

*Originally created by @ItalyPaleAle on 6/9/2025* ### Reproduction steps When using the Device Code flow with Pocket ID, calls to the `/api/oidc/device/authorize` require a `client_secret` ### Expected behavior Per [RFC 8628 sec 3.1](https://datatracker.ietf.org/doc/html/rfc8628#section-3.1) the device authorization request endpoint should not require a client secret. This is because clients are assumed to be public. [Section 5.6](https://datatracker.ietf.org/doc/html/rfc8628#section-5.6) calls this out: > Device clients are generally incapable of maintaining the confidentiality of their credentials, as users in possession of the device can reverse-engineer it and extract the credentials. ### Actual Behavior Client secret is required ### Version and Environment main branch ### Log Output _No response_

AtHeartEngineer closed this issue

2025-07-08 08:39:12 -04:00

AtHeartEngineer added the bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug labels 2025-07-08 08:39:13 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pocket-id#80