Subject: Re: [OAUTH-WG] Should replay of access token request be allowed?

From: Brian Eaton <[email-masked]>
Date: Tue, 1 Jun 2010 09:48:51 -0700

On Sun, May 30, 2010 at 9:47 AM, Dick Hardt <[email-masked]> wrote:
> I think so. In WRAP the verification code was RECOMMENDED one time use.

Yep.  Servers must enforce time-limits on verification codes.  Servers
may make verification codes single use tokens.  Clients must not
attempt to redeem a verification code more than once.