GitHub Authentication via client_id in HTTP POST

Tim Peck@timpeck

•updated Nov 11, 2025•1•0•37

This rule detects HTTP POST requests to github.com's /login/device/code endpoint that contain a 'client_id=' in the request body. This pattern is indicative of a device code authentication flow, which could be leveraged in phishing attacks (device code phishing) to steal application access tokens.