Subject: Re: [OAUTH-WG] Stephen Farrell's Discuss on draft-ietf-oauth-json-web-token-27: (with DISCUSS and COMMENT)

From: Carsten Bormann <[email-masked]>
Date: Mon, 3 Aug 2020 16:42:06 +0200

On 2014-10-06, at 09:54, Mike Jones <[email-masked]> wrote:

>> - 4.1.7: maybe worth adding that jti+iss being unique enough is not sufficient and
>> jti alone has to meet that need. In
>> X.509 the issuer/serial has the equivalent property so someone might assume
>> sequential jti values starting at 0 are ok.
> 
> Makes sense to add a warning of some kind along these lines.  I think I know the reasons you say that, but can you expand on that thought a bit before I take a stab on writing this up?  For instance, while normally true, I don't think your observation is true if a relying party will only accept tokens from a single issuer.

So can someone remind me why jti needs to be unique globally, and not just per issuer?

Grüße, Carsten

---

From: Carsten Bormann <[email-masked]>
Date: Tue, 11 Aug 2020 14:55:15 +0200

> So can someone remind me why jti needs to be unique globally, and not just per issuer?

Anyone?

Grüße, Carsten