mirror of
https://forgejo.ellis.link/continuwuation/continuwuity.git
synced 2026-11-14 12:46:49 +00:00
Michel-Marie MAUDET
8c1bbf3d1a
The device authorization endpoint issued a device code to any registered client, without checking that the client had registered the `urn:ietf:params:oauth:grant-type:device_code` grant type. Such a client could therefore start a device authorization flow and have the server show an approval prompt to a user, even though the subsequent token request was always going to be refused. RFC 8628 section 3.2 states that, in the event of an error such as an invalidly configured client, the device authorization endpoint responds in the same way as the token endpoint specified in RFC 6749 section 5.2, which defines `unauthorized_client` as "the authenticated client is not authorized to use this authorization grant type". Apply the same grant type check the token endpoint already performs, and add the `unauthorized_client` error code it requires.