6

RFC 8628 doesn't state that the client_secret parameter is needed for Device Access Token Request: https://datatracker.ietf.org/doc/html/rfc8628#section-3.4

When I do such a request using Google API

$ curl --request POST \
  --url 'https://oauth2.googleapis.com/token' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data 'grant_type=urn:ietf:params:oauth:grant-type:device_code' \
  --data 'device_code=...' \
  --data 'client_id=...'

I get the following error:

{
  "error": "invalid_request",
  "error_description": "Missing required parameter: client_secret"
}

If I pass client_secret, it works.

I'd be grateful if anyone could answer my two questions:

  1. Why does Google API require client_secret for the device flow? OAuth 2.0 for TV and Limited-Input Device Applications doesn't offer any explanation.
  2. Is it safe to expose client_secret, assuming that my client belongs to the "Client ID for TV and Limited Input" type? I assume it's generally discouraged, so I'd like to limit this question to Google API only. My application can be downloaded, and the secret is basically hardcoded, thus exposed to everyone. If the secret gets leaked, I'm wondering what are the implications.
mvlabat
  • 577
  • 4
  • 17

1 Answers1

0

You are sending the request to the standard oauth2 endpoint

https://oauth2.googleapis.com/token

While the device code endpoint is

https://oauth2.googleapis.com/device/code

Consulting this page as you are using the standard oauth2 endpoint you are probably falling under this section

enter image description here

Instead of this section which would expect you to be using the device endpoint.

enter image description here

This is the example found on that page for use with a TVs and Limited Input devices client.

curl -d "client_id=client_id&scope=email%20profile" \
     https://oauth2.googleapis.com/device/code
Linda Lawton - DaImTo
  • 106,405
  • 32
  • 180
  • 449
  • Hi! Thanks for the answer. Sorry if I worded my question poorly. I can send a request to the https://oauth2.googleapis.com/device/code endpoint just fine. The documentation later suggests that I should be polling the https://oauth2.googleapis.com/token endpoint (which comes in the verification_url in the response from https://oauth2.googleapis.com/device/code) to confirm that a user has granted the access. The token endpoint requires client_secret, which seems to violate the standard (RFC 8628). – mvlabat Dec 06 '21 at 17:18