oauth-2.0 - How to disable device flow and implicit flow in identity server?

Question

I am using Identity Server 4 and developing a financial application. I assume that none of the API clients will be using device code flow. And hence as a security good practice, I want to disable it for all clients and hide it in discovery document. I have checked the identity server official document but did not find any resources. so my question is.

1. How can I disable the device code flow grant type for all the clients.
2. How can I hide it in the discovery document.

标签： oauth-2.0identityserver4

Answer 1

您可以禁用端点：

services
    .AddIdentityServer(options =>
    {
        options.Endpoints.EnableDeviceAuthorizationEndpoint = false;
    })

这也应该将其从发现文档中删除。

请注意，您不能为客户端禁用流，因为您必须明确配置客户端才能使用它。换句话说，由于客户端没有配置为使用授权类型，它不能使用它。无需以其他方式禁用它。

如果端点可用且可见，则您无法隐藏每个客户端的端点。这是一份公开文件。