[art] draft-ietf-oauth-status-list-13 ietf last call Artart review

John Levine via Datatracker <noreply@ietf.org> Mon, 24 November 2025 02:36 UTC

MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: John Levine via Datatracker <noreply@ietf.org>
To: art@ietf.org
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <176395180469.2160358.17562138055606795326@dt-datatracker-5bd94c585b-wk4l4>
Date: Sun, 23 Nov 2025 18:36:44 -0800
Message-ID-Hash: U45NPVFODN2ZDIUQOYJRXP2XPLI47N7J
CC: draft-ietf-oauth-status-list.all@ietf.org, last-call@ietf.org, oauth@ietf.org
Reply-To: John Levine <johnl@taugh.com>
Subject: [art] draft-ietf-oauth-status-list-13 ietf last call Artart review
Archived-At: <https://mailarchive.ietf.org/arch/msg/art/xsiOPSAO1dMnbg2IrgA5xbTiWG4>

Document: draft-ietf-oauth-status-list
Title: Token Status List (TSL)
Reviewer: John Levine
Review result: Ready

While I am familiar with the bits of technology this draft uses, I am not very
familiar with the whole token ecosystem, so this review is somewhat like one
written by a reviewer who arrived during the third act of a five act opera. The
description of the various encodings and embeddings are clear enough, and the
discussions of threats, particularly using huge sets of status items to keep
publishers from knowing which item you're looking for, makes sense.

[art] draft-ietf-oauth-status-list-13 ietf last c… John Levine via Datatracker