mirror of
https://github.com/coder/coder.git
synced 2026-09-24 15:04:27 +08:00
The [OAuth2 specification](https://datatracker.ietf.org/doc/html/rfc8628) describes how clients in the device flow should handle retrying requests when they are rate limited. We didn't respect it, which sometimes prevented users from logging in or setting up external auth. They'd see a `slow_down` error in the UI and would be unable to complete the authentication flow. This PR implements rate limit handling according to the spec.