Implement authentication with MagicCode
I'm currently trying to build a new system that would mimic how you could log in on a smart TV with Netflix/AmazonPrime/Disney+ :
- A code is displayed on the device A.
- You enter this code on an authenticated device B.
- The Device A gets token so it could communicate as authenticated.
The system looks like so:
the code works like so: - The Device A call API route sending infos
- Auth service generate a MagicCode, saves infos with magic code as ID and returns MagicCode to Device A.
- Device B calls API route with MagicCode
- If magic code is still valid it returns the infos to Device B and Sends Auth Token to Device A
My problems are:
- I don't know how to send back the tokens to the device A. I can't call Device A since I have no idea how the network of this one will be configured. So Device A must be the one calling. The magic code can take up to few minutes to be entered in the Device B so wait for the answer of a standard HTTP call sounds risky as many layers in the infrastructure could just shot down the socket connection and lead to a time out.
How could i manage that ? - My magic code is generated usic cryptographic, it's the same algorithme as for a 6 digit OTP (one time password). For one time password, you generate with an ID and you check the validity with the same ID. Meaning you must have common ID value on both ends.In the case of my magic Code, I don't (that i know) have any common value on both devices so my magic code could just be a random string of 6 character it would be the same. It doesn't sound totally safe and 'im wondering if there is a better way to do this ?
Just for reference i'm using .Net but the question is broader that that.
Solution
For anyone wondering:
This way of doing is called "Device flow" and it's in the Oauth 2.0 Spec
Great explanation here
- WebAuthn: Can't create public key. Promise is rejected
- FastAPI authentication injection
- Swift - Sign in with apple always results in 'Sign up not completed' after the facial recognition runs
- How to add authentication for Swift in Xcode environment
- What are the main differences between JWT and OAuth authentication?
- Laravel 419 Page Expired on Hosting but Works Locally
- How can I log in and authenticate to PostgreSQL after a fresh install?
- What is a Pythonic way for Dependency Injection?
- Paypal auth not behaving correctly
- Symfony custom authenticator and form login ldap at the same time
- How to add user authentication to specific endpoints in FastAPI?
- How to configure command line git to use ssh key
- How to enable remember password in case of AJAX login?
- Cannot switch from user myself back to root using `su` command, it reports authentication failure. `sudo` command not found either
- Swipe a splash screen to get to a login screen (Android Application)
- laravel5.2 Auth::guest() returns error "Class 'App\Http\Controllers\Auth' not found"
- troubleshooting Cakephp auth component not allowing allowed actions
- Docker private registry insufficient_scope when trying to delete image
- LoginAsync Always Returns False in Blazor WebAssembly with ASP.NET Core 9 Cookie Authentication
- CloudKit server-to-server authentication
- Problems with setting up JWT Bearer authentication in ASP.NET Core
- AADSTS500208 "domain is not a valid login domain" error when migrating Blazor WASM from Azure AD B2C to Entra External ID
- Laravel sanctum SPA authentication with multiple different user models
- C# Flurl - Add WebRequestHandler to FlurlClient
- Laravel 9 email verification Invalid Signature
- JWT Cookie Removed After Page Refresh in React App (Frontend Localhost, Backend Server)
- using refresh token to get new access token react and node js
- authentication fails with Spring Security with "permitAll"
- Flutter: how to check if user is logged in by using flutter_secure_storage
- Does Passport's logout function remove the cookie? If not, how does it work?