git-ecosystem / git-ecosystem/git-credential-manager

Show QR code for OAuth device authentication

Open
#1,437 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

auth:oauth enhancement help-wanted
Dominant language
C#
Stars
9.3k
Forks
2.9k
Avg merge
7d 1h
Merged PRs (30d)
14

Description

When the OAuth device response includes the verification_uri_complete parameter, it would be neat to show a QR code to help open this URL on another device.

https://datatracker.ietf.org/doc/html/rfc8628#section-3.3.1

When "verification_uri_complete" is included in the authorization response, clients MAY present this URI in a non-textual manner using any method that results in the browser being opened with the URI, such as with QR (Quick Response) codes or NFC (Near Field Communication), to save the user from typing the URI.

For usability reasons, it is RECOMMENDED for clients to still display the textual verification URI ("verification_uri") for users who are not able to use such a shortcut. Clients MUST still display the "user_code", as the authorization server will require the user to confirm it to disambiguate devices or as remote phishing mitigation.

            +-------------------------------------------------+
            |                                                 |
            |  Scan the QR code or, using     +------------+  |
            |  a browser on another device,   |[_]..  . [_]|  |
            |  visit:                         | .  ..   . .|  |
            |  https://example.com/device     | . .  . ....|  |
            |                                 |.   . . .   |  |
            |  And enter the code:            |[_]. ... .  |  |
            |  WDJB-MJHT                      +------------+  |
            |                                                 |
            +-------------------------------------------------+

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the OAuth device authentication flow that handles verification_uri_complete, then review RFC 8628 section 3.3.1 and the existing user-facing output. Done means displaying a QR code when the parameter is present while retaining the verification URI and user code for users who cannot scan it.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
authentication
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.