Subject: [OAUTH-WG] access_token and UUID

From: HAMANO Tsukasa <[email-masked]>
Date: Thu, 27 Nov 2014 12:06:27 +0900

Hi,

I have question about access_token generation.
Would it be possible to use access_token that generated as UUID?
It seems reasonable so UUID is regarded as safe ID generation
algorithm. And in fact such OAuth 2.0 implementations exists.
But there is a discrepancy between OAuth 2.0 spec and UUID spec around
letter case.

RFC 6749 says:
> Unless otherwise noted, all the protocol parameter names and values
> are case sensitive.

> access_token
> REQUIRED.  The access token issued by the authorization server.

RFC 4122 says:
> The hexadecimal values "a" through "f" are output as lower case
> characters and are case insensitive on input.

I mean, access_token should be treated as case sensitive but UUID
should be treated as case insensitive.
What are your thoughts on that?

Thank you.

-- 
Open Source Solution Technology Corporation
HAMANO Tsukasa <[email-masked]>
fingerprint = 2285 2111 6D34 3816 3C2E  A5B9 16BE D101 6069 BE55