Subject: [OAUTH-WG] Message ID for draft-jones-oauth-jwt-bearer

From: John Bradley <[email-masked]>
Date: Wed, 23 Nov 2011 22:01:50 -0300

The draft-jones-oauth-jwt-bearer profile is lacking a message ID that exists in the SAML version.

This is important for the receiver to detect replay attacks.

For Connect I made up a claim to use:

tid  The tid (token id) claim, A nonce or unique identifier for the assertion. The Assertion ID may be used by implementations requiring message de- duplication for one-time use assertions.

I was tempted to use mid (Message ID) however it is the id of the token not the message.

If you add something I will change the claim to be consistent.

I think it needs to be in your spec.

Regards
John B.

---

From: Mike Jones <[email-masked]>
Date: Thu, 24 Nov 2011 01:21:23 +0000

Thanks John.  This makes sense to me.

Feedback from others?

                                                            -- Mike

From: John Bradley [mailto:[email-masked]]
Sent: Wednesday, November 23, 2011 5:02 PM
To: oauth WG
Cc: Mike Jones
Subject: Message ID for draft-jones-oauth-jwt-bearer

The draft-jones-oauth-jwt-bearer<http://tools.ietf.org/html/draft-jones-oauth-jwt-bearer-02> profile is lacking a message ID that exists in the SAML version.

Regards
John B.

---

From: Mike Jones <[email-masked]>
Date: Thu, 24 Nov 2011 01:27:47 +0000

Thinking about it a bit more, since others may want to use "tid" for claims with meanings like Transaction ID ( or other words beginning with "t"), maybe the claim name should be "jti" (JSON web Token ID) to reduce chance of name collisions?

                                                            -- Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of Mike Jones
Sent: Wednesday, November 23, 2011 5:21 PM
To: John Bradley; oauth WG
Subject: Re: [OAUTH-WG] Message ID for draft-jones-oauth-jwt-bearer

Feedback from others?

                                                            -- Mike

From: John Bradley [mailto:[email-masked]]<mailto:[mailto:[email-masked]]>
Sent: Wednesday, November 23, 2011 5:02 PM
To: oauth WG
Cc: Mike Jones
Subject: Message ID for draft-jones-oauth-jwt-bearer

Regards
John B.

---

From: John Bradley <[email-masked]>
Date: Wed, 23 Nov 2011 23:11:35 -0300

With only three characters combinations are at a premium.

People can all ways use longer names.  

The ones that are going to be in most tokens are the important ones to keep short and memorable.  

tid seems clearer than jti, but that is just me.  I will go with whatever is decided.

John B
Sent from my iPad

On 2011-11-23, at 10:27 PM, Mike Jones <[email-masked]> wrote:

> Thinking about it a bit more, since others may want to use “tid” for claims with meanings like Transaction ID ( or other words beginning with “t”), maybe the claim name should be “jti” (JSON web Token ID) to reduce chance of name collisions?
>  
>                                                             -- Mike
>