Subject: [OAUTH-WG] Token expiration

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 21 Sep 2009 14:25:29 -0700

Should the core spec support the ability to indicate the duration of token credentials? This would be an addition to the web delegation draft [1] in section 6 (Token Credentials) in the form of a new response parameter, something like:

oauth_token_duration
    The token duration specified in second from the time of the HTTP response timestamp.

This has been consistently at the top of missing core funcationality.

EHL

[1] http://tools.ietf.org/html/draft-ietf-oauth-web-delegation-01

---

From: Hubert Le Van Gong <[email-masked]>
Date: Mon, 21 Sep 2009 23:41:08 +0200

It is obviously useful to have. In fact it's so useful I'll bet most
token format
used do include one. Having it outside the token becomes redundant then but
maybe it's not that bad.

BTW why not using dateTime (http://www.w3.org/TR/xmlschema-2/#dateTime)?

Cheers,
Hubert

On Mon, Sep 21, 2009 at 11:25 PM, Eran Hammer-Lahav <[email-masked]> wrote:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Chris Messina <[email-masked]>
Date: Mon, 21 Sep 2009 15:22:12 -0700

Seems like it'd be worth documenting existing approaches to this... what do
other similar APIs do?
I know I harp on this approach to technology development, but that was how
OAuth was developed (for better or worse): by looking at existing practices,
extracting convention, and codifying ]ideally] best practices.

If this is common and working elsewhere, can't we just imitate it?

Chris

On Mon, Sep 21, 2009 at 2:41 PM, Hubert Le Van Gong <[email-masked]>wrote:

> > Should the core spec support the ability to indicate the duration of
> token credentials? This would be an addition to the web delegation draft [1]
> in section 6 (Token Credentials) in the form of a new response parameter,
> something like:
> >
> > oauth_token_duration

-- 
Chris Messina
Open Web Advocate

Personal: http://factoryjoe.com
Follow me on Twitter: http://twitter.com/chrismessina

Citizen Agency: http://citizenagency.com
Diso Project: http://diso-project.org
OpenID Foundation: http://openid.net

This email is:   [ ] shareable    [X] ask first   [ ] private

---

From: Hubert Le Van Gong <[email-masked]>
Date: Tue, 22 Sep 2009 00:34:56 +0200

An interesting example (to me at least since we use it) is the SAML token.
You have the ability to define three dates:
- IssueInstant: the time of issue of the token [required]
- NotBefore: time before which the token's invalid [optional]
- NotOnOrAfter: time after which the token becomes invalid [optional]

All are dateTime (in UTC form).

Thanks,
Hubert

---

From: Jonathan Sergent <[email-masked]>
Date: Mon, 21 Sep 2009 15:47:50 -0700

IMO, it's problematic that this relies on clock synchronization
between the sender and the receiver to work.  This is a constant
source of problems in need of debugging for us today.  Why not specify
times like this using intervals?  "This token is valid for the next n
seconds."

---

From: Marcel Molina <[email-masked]>
Date: Mon, 21 Sep 2009 15:54:44 -0700

As an example of what other APIs do, Amazon's S3 supports signed urls
of protected objects. The signed url is given a time to live after
which it's invalidated. It's specified in terms of number of seconds
from the time the url was generated. That's dependent on the clock of
the origin server I assume.

Unless there is considerable drift between clocks and a very short
time to live on the token, this shouldn't be a problem 99%+ of the
time I'd assume...

-- 
Marcel Molina
Twitter Platform Team
http://twitter.com/noradio

---

From: Hubert Le Van Gong <[email-masked]>
Date: Tue, 22 Sep 2009 01:00:58 +0200

In theory I'd agree with you but...
(1) there are ways of achieving reasonable clock sync nowadays
(2) usually the validity period is long enough that the clocks are
     considered roughly in sync.
(3) the n seconds means I can keep the token for a very long period
    of time and present it? Unless you meant seconds starting from
    the sender's clock, in which case we're back to the same issue.

If the token is for a sensitive resource, one can still impose a one time use...

My 2 cents,
Hubert

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 21 Sep 2009 16:17:51 -0700

Yahoo uses 'oauth_expires_in' as specified in the session extension [1] (which we plan to submit as an I-D shortly).

EHL

[1] http://oauth.googlecode.com/svn/spec/ext/session/1.0/drafts/1/spec.html

From: [email-masked] [mailto:[email-masked]] On Behalf Of Chris Messina
Sent: Monday, September 21, 2009 3:22 PM
To: Hubert Le Van Gong
Cc: [email-masked]
Subject: Re: [OAUTH-WG] Token expiration

Seems like it'd be worth documenting existing approaches to this... what do other similar APIs do?

I know I harp on this approach to technology development, but that was how OAuth was developed (for better or worse): by looking at existing practices, extracting convention, and codifying ]ideally] best practices.

Chris

On Mon, Sep 21, 2009 at 2:41 PM, Hubert Le Van Gong <[email-masked]<mailto:[email-masked]>> wrote:
It is obviously useful to have. In fact it's so useful I'll bet most
token format
used do include one. Having it outside the token becomes redundant then but
maybe it's not that bad.

Cheers,
Hubert

On Mon, Sep 21, 2009 at 11:25 PM, Eran Hammer-Lahav <[email-masked]<mailto:[email-masked]>> wrote:
> [email-masked]<mailto:[email-masked]>
_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

--
Chris Messina
Open Web Advocate

---

From: Jonathan Sergent <[email-masked]>
Date: Mon, 21 Sep 2009 16:23:38 -0700

I meant n seconds from when the response was sent by the server.

---

From: Chris Messina <[email-masked]>
Date: Mon, 21 Sep 2009 22:35:24 -0700

It'd be great if we could document all these techniques on the wiki:
http://wiki.oauth.net

Mailing lists is where good research like this goes to die!

Chris

On Mon, Sep 21, 2009 at 4:23 PM, Jonathan Sergent <[email-masked]>wrote:

> >>>> On Mon, Sep 21, 2009 at 2:41 PM, Hubert Le Van Gong <
> [email-masked]>
> >>>> wrote:
> >>>>>
> >>>>> used do include one. Having it outside the token becomes redundant
> then
> >>>>> but
> >>>>> maybe it's not that bad.
> >>>>>
> >>>>> BTW why not using dateTime (
> http://www.w3.org/TR/xmlschema-2/#dateTime)?
> >>>>>
> >>>>> Cheers,
> >>>>> Hubert
> >>>>>
> >>>>>
> >>>>> On Mon, Sep 21, 2009 at 11:25 PM, Eran Hammer-Lahav <
> [email-masked]>
> >>>>> wrote:

-- 
Chris Messina
Open Web Advocate