IETF Publishes Best Current Practice for Cross-Device Flow Security
New IETF BCP (RFC 10027) details cross-device flow security threats, real-world exploits, and mitigation strategies for engineers and architects.
The IETF has released RFC 10027 / BCP 247, a Best Current Practice document addressing security threats in cross-device flows—the QR code, PIN, or push-notification patterns used when a user authorizes one device (like a smart TV) using another (like a phone). It covers both cross-device authorization flows and cross-device session transfer, distinguishing the distinct attack surfaces of each.
The core vulnerability the document highlights is that the channel transferring authorization requests between devices is unauthenticated, leaving users solely responsible for judging whether to trust the request context—a gap attackers can exploit for unauthorized access. The BCP walks through real-world patterns (video streaming, productivity apps, bike-sharing, financial transactions, network onboarding) alongside matching exploit examples for each.
For engineers and architects, the document is a practical playbook: it catalogs mitigations such as proximity verification, short-lived and one-time codes, sender-constrained tokens, rate limiting, and UX safeguards, then offers protocol selection guidance comparing OAuth 2.0 Device Authorization Grant, OpenID CIBA, and FIDO2/WebAuthn for building safer cross-device authentication.