Subject: [OAUTH-WG] exp claim ... was RE: expires_in

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 18 Dec 2018 13:48:46 +0000

Hi David,

You just caught an error. Thanks.

There is the expires_in parameter sent from the AS to the client and the exp claim in the access token created by the AS for consumption by the RS.

I meant to write about the exp claim but I instead looked up the expires_in. The value in the expires_in parameter is also in my opinion advisory. The exp parameter shouldn't be.

Interestingly RFC 6819 nor draft-ietf-oauth-security-topics-10 only talk about having a mandatory exp claim in the access token. In OpenID Connect exp is a mandatory claim.

Ciao
Hannes

-----Original Message-----
From: David Waite <[email-masked]>
Sent: Dienstag, 18. Dezember 2018 12:59
To: Hannes Tschofenig <[email-masked]>
Cc: oauth <[email-masked]>
Subject: Re: [OAUTH-WG] expires_in

My understanding was that this parameter was advisory to the client - it neither mandated the client discard the token after the expires_in time, nor has a requirement that the token is no longer honored by protected resouces at that point in time (vs earlier or later).

Is there meaning that others assign to this value? The only use I’ve found is to schedule proactive refreshes to hopefully reduce latency by reducing the need to refresh in-line with user requests.

-DW

> On Dec 18, 2018, at 3:55 AM, Hannes Tschofenig <[email-masked]> wrote:
>
> Hi all,
>
> In a recent email conversation on the IETF ACE mailing list Ludwig Seitz suggested that the expires_in claim in an access token should actually be mandatory.
> Intuitively it feels like access tokens shouldn't have an unrestricted lifetime. I am curious whether recommendations would be useful here.
>
> RFC 6819 talks about the expires_in claim and says:
>
> 3.1.2.  Limited Access Token Lifetime
>
>   The protocol parameter "expires_in" allows an authorization server
>   (based on its policies or on behalf of the end user) to limit the
>   lifetime of an access token and to pass this information to the
>   client.  This mechanism can be used to issue short-lived tokens to
>   OAuth clients that the authorization server deems less secure, or
>   where sending tokens over non-secure channels.
>
> draft-ietf-oauth-security-topics-10 only talks about refresh token expiry.
>
> In OpenID Connect the expires_in claim is also optional.
>
> Ciao
> Hannes
>
> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Aaron Parecki <[email-masked]>
Date: Tue, 18 Dec 2018 08:06:28 -0800

The "exp" claim is an implementation detail of one type of access token,
but obviously doesn't have any meaning to someone using non-JWT tokens.
Since not everyone is using JWT access tokens, it seems strange to have a
mention of a JWT-specific detail.

That said, it sounds like the proposal is to recommend access tokens always
have an expiration date? In that case, is it also important that the
expiration date be communicated to the client?

----
Aaron Parecki
aaronparecki.com
@aaronpk <http://twitter.com/aaronpk>

On Tue, Dec 18, 2018 at 5:49 AM Hannes Tschofenig <[email-masked]>
wrote:

> There is the expires_in parameter sent from the AS to the client and the
> exp claim in the access token created by the AS for consumption by the RS.
>
> I meant to write about the exp claim but I instead looked up the
> expires_in. The value in the expires_in parameter is also in my opinion
> advisory. The exp parameter shouldn't be.
>
> Interestingly RFC 6819 nor draft-ietf-oauth-security-topics-10 only talk
> about having a mandatory exp claim in the access token. In OpenID Connect
> exp is a mandatory claim.
>
> Ciao
> Hannes
>
> My understanding was that this parameter was advisory to the client - it
> neither mandated the client discard the token after the expires_in time,
> nor has a requirement that the token is no longer honored by protected
> resouces at that point in time (vs earlier or later).
>
> Is there meaning that others assign to this value? The only use I’ve found
> is to schedule proactive refreshes to hopefully reduce latency by reducing
> the need to refresh in-line with user requests.
>
> -DW
>
> > In a recent email conversation on the IETF ACE mailing list Ludwig Seitz
> suggested that the expires_in claim in an access token should actually be
> mandatory.
> > Intuitively it feels like access tokens shouldn't have an unrestricted
> lifetime. I am curious whether recommendations would be useful here.
> >
> > IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.
> >
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.

---

From: Ludwig Seitz <[email-masked]>
Date: Wed, 19 Dec 2018 08:35:03 +0100

On 18/12/2018 17:06, Aaron Parecki wrote:
> Since not everyone is using JWT access tokens, it seems strange to have 
> a mention of a JWT-specific detail.
> 
> That said, it sounds like the proposal is to recommend access tokens 
> always have an expiration date? In that case, is it also important that 
> the expiration date be communicated to the client?
> 

The original context was from the ACE WG. In ACE we use pop-tokens 
exclusively and it is important in some usecases that the client no 
longer uses the pop-key material when the token has expired.

/Ludwig

-- 
Ludwig Seitz, PhD
Security Lab, RISE
Phone +46(0)70-349 92 51