DefaultDeviceFlowInteractionService - Remember Consent not implemented

[cjaliaga]

Hi! I noticed there’s a TODO in DefaultDeviceFlowInteractionService around recording consent for device flow when RememberConsent is enabled:

https://github.com/DuendeSoftware/products/blob/e556d5b314fbbf6b3231d8444393bc73f4d938ff/identity-server/src/IdentityServer/Services/Default/DefaultDeviceFlowInteractionService.cs#L92-L97

// TODO: Device Flow - Record consent template
if (consent.RememberConsent)
{
    //var consentRequest = new ConsentRequest(request, subject);
    //await _consentMessageStore.WriteAsync(consentRequest.Id, new Message<ConsentResponse>(consent, _clock.UtcNow.UtcDateTime));
}

I’m aware we can override the interaction service and implement our own persistence, but before doing that I wanted to ask: was this left unimplemented due to any non-obvious considerations (security/privacy, consent semantics in device flow, edge cases, etc.)?

Basically: is there anything we should be careful about if we implement “remember consent” for device flow in a straightforward way?

[wcabus]

This TODO has been there for a long time, but was never implemented because we didn't see anyone asking for it until now 🙂
We're interested to know your use-case for requiring this!

If you are to implement your own service, things to consider are:

• Device flow happens on potentially untrusted devices: auto-approval should be conservative (exact scope intersection, not superset)
• Client.AllowRememberConsent should gate this behavior

[josephdecock]

Another security consideration that is very important is that cross device flows are vulnerable to phishing/social engineering techniques because the channel between the consumption device and the authorization device is unauthenticated. Basically attackers will start a device flow, and fool victims into this interaction:

1. click on a link or scan a QR code that uses their code
2. approve authorization

If you build a "remember consent" mechanism that makes 2 happen automatically, that makes these attacks a lot easier.