Subject: [OAUTH-WG] Renaming expires to expires_in?

From: David Recordon <[email-masked]>
Date: Mon, 5 Apr 2010 09:09:41 -0700

As one of our engineers was implementing a client, they got confused about what was being returned by the expires parameter. Anyone object to renaming it to expires_in so that it's clear that it isn't an absolute timestamp?

Thanks,
--David

---

From: Paul Lindner <[email-masked]>
Date: Mon, 5 Apr 2010 09:46:55 -0700

+1

This would more closely match the nomenclature used by the oauth session
extension<http://oauth.googlecode.com/svn/spec/ext/session/1.0/drafts/1/spec.html>
.

On Mon, Apr 5, 2010 at 9:09 AM, David Recordon
<[email-masked]>wrote:

> As one of our engineers was implementing a client, they got confused about
> what was being returned by the expires parameter. Anyone object to renaming
> it to expires_in so that it's clear that it isn't an absolute timestamp?
>
> Thanks,
> --David
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Richard Barnes <[email-masked]>
Date: Mon, 5 Apr 2010 13:28:35 -0400

Ok, maybe something like "lifetime"?

On Apr 5, 2010, at 12:46 PM, Paul Lindner wrote:

> +1
>
> This would more closely match the nomenclature used by the oauth  
> session extension.
>
>
> On Mon, Apr 5, 2010 at 9:09 AM, David Recordon <[email-masked] 
> > wrote:
> As one of our engineers was implementing a client, they got confused  
> about what was being returned by the expires parameter. Anyone  
> object to renaming it to expires_in so that it's clear that it isn't  
> an absolute timestamp?
>
> Thanks,
> --David

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Tue, 6 Apr 2010 00:11:18 -0700

Changed to 'duration'.

EHL

On 4/5/10 9:09 AM, "David Recordon" <[email-masked]> wrote:

Thanks,
--David

---

From: Luke Shepard <[email-masked]>
Date: Tue, 6 Apr 2010 08:24:30 -0700

Just curious, where did "duration" come from?

I hate to be picky, but I feel like "expires_in" is more clear than "duration" ... if only because other protocols (OAuth 1.0a, OpenID, Facebook auth) use "expires".

On Apr 6, 2010, at 12:11 AM, Eran Hammer-Lahav wrote:

Changed to ‘duration’.

EHL

On 4/5/10 9:09 AM, "David Recordon" <[email-masked]<x-msg://353/[email-masked]>> wrote:

Thanks,
--David
_______________________________________________
OAuth mailing list
[email-masked]<x-msg://353/[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

<ATT00001..txt>

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Tue, 6 Apr 2010 14:46:23 -0700

"The duration in seconds of the access token lifetime."

I liked 'lifetime' better than 'expires_in' (for no particular reason), but lifetime can mean number of uses.

EHL

On 4/6/10 8:24 AM, "Luke Shepard" <[email-masked]> wrote:

Changed to 'duration'.

EHL

On 4/5/10 9:09 AM, "David Recordon" <[email-masked] <x-msg://353/[email-masked]> > wrote:

Thanks,
--David
_______________________________________________
OAuth mailing list
[email-masked] <x-msg://353/[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

<ATT00001..txt>

---

From: Brian Eaton <[email-masked]>
Date: Tue, 6 Apr 2010 22:33:32 -0700

On Tue, Apr 6, 2010 at 8:24 AM, Luke Shepard <[email-masked]> wrote:
> I hate to be picky, but I feel like "expires_in" is more clear than
> "duration" ... if only because other protocols (OAuth 1.0a, OpenID, Facebook
> auth) use "expires".

"duration" is pretty vague.  "expires" or "expires_in" are both fine by me.

---

From: Torsten Lodderstedt <[email-masked]>
Date: Mon, 12 Apr 2010 21:10:08 +0200

What is the reason for using a relativ token lifetime specification? 
SAML2 uses an absolute specification in datetime format (NotOnOrAfter)

Am 07.04.2010 07:33, schrieb Brian Eaton:
> On Tue, Apr 6, 2010 at 8:24 AM, Luke Shepard<[email-masked]>  wrote:
>

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 12 Apr 2010 13:38:11 -0700

Relative doesn't require clock sync. It works well if there isn't a significant delay in receiving the reply.

EHL

On 4/12/10 12:10 PM, "Torsten Lodderstedt" <[email-masked]> wrote: