[OAUTH-WG] polling in the device flow

[Dirk Balfanz <[e-mail]>]

Hi guys,

currently, we specify how polling should work in the device flow as part of
the OAuth2 spec.

I would argue that that polling should be handled at a lower layer of the
stack, and that OAuth2 should be silent on the issue of polling. The benefit
will be a simpler spec.

HTTP specifies the 503 response code with the (optional) Retry-After
response header. ASs could just use that mechanism to throttle clients,
instead of handling it at the OAuth layer.

The OAuth spec could say something like: "The client requests the access
token after the user approves or rejects authorization. If the client cannot
determine when the user has approved or rejected the authorization, the
client MAY poll the server. The server MAY use throttling mechanisms such as
503 HTTP response codes and Retry-After response headers which, if used, the
client MUST obey."

What do you guys think?

BTW, there is some precedence for this. Google's APIs use 503 response codes
to throttle servers, e.g.
http://code.google.com/googleapps/domain/gdata_provisioning_api_v2.0_reference.html

Dirk.