[OAUTH-WG] State Size
Anthony Nadalin <tonynad@microsoft.com> Thu, 11 August 2011 17:34 UTC
Return-Path: <tonynad@microsoft.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E80721F8C4B for <oauth@ietfa.amsl.com>; Thu, 11 Aug 2011 10:34:13 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.466
X-Spam-Level:
X-Spam-Status: No, score=-7.466 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8, UNRESOLVED_TEMPLATE=3.132]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cWZFsLQzx6ho for <oauth@ietfa.amsl.com>; Thu, 11 Aug 2011 10:34:12 -0700 (PDT)
Received: from smtp.microsoft.com (mailc.microsoft.com [131.107.115.214]) by ietfa.amsl.com (Postfix) with ESMTP id 948B221F8C3C for <oauth@ietf.org>; Thu, 11 Aug 2011 10:34:12 -0700 (PDT)
Received: from TK5EX14MLTC101.redmond.corp.microsoft.com (157.54.79.178) by TK5-EXGWY-E803.partners.extranet.microsoft.com (10.251.56.169) with Microsoft SMTP Server (TLS) id 8.2.176.0; Thu, 11 Aug 2011 10:34:47 -0700
Received: from VA3EHSOBE002.bigfish.com (157.54.51.112) by mail.microsoft.com (157.54.79.178) with Microsoft SMTP Server (TLS) id 14.1.323.7; Thu, 11 Aug 2011 10:34:47 -0700
Received: from mail192-va3-R.bigfish.com (10.7.14.243) by VA3EHSOBE002.bigfish.com (10.7.40.22) with Microsoft SMTP Server id 14.1.225.22; Thu, 11 Aug 2011 17:34:33 +0000
Received: from mail192-va3 (localhost.localdomain [127.0.0.1]) by mail192-va3-R.bigfish.com (Postfix) with ESMTP id 55781178266 for <oauth@ietf.org.FOPE.CONNECTOR.OVERRIDE>; Thu, 11 Aug 2011 17:34:33 +0000 (UTC)
X-SpamScore: 3
X-BigFish: PS3(zzc85fhzz1202h1082kzz8275bh8275dhz31h2a8h668h839h63h)
X-Spam-TCS-SCL: 2:0
X-Forefront-Antispam-Report: CIP:207.46.4.139; KIP:(null); UIP:(null); IPV:SKI; H:SN2PRD0302HT004.namprd03.prod.outlook.com; R:internal; EFV:INT
Received-SPF: softfail (mail192-va3: transitioning domain of microsoft.com does not designate 207.46.4.139 as permitted sender) client-ip=207.46.4.139; envelope-from=tonynad@microsoft.com; helo=SN2PRD0302HT004.namprd03.prod.outlook.com ; .outlook.com ;
Received: from mail192-va3 (localhost.localdomain [127.0.0.1]) by mail192-va3 (MessageSwitch) id 1313084072845373_15344; Thu, 11 Aug 2011 17:34:32 +0000 (UTC)
Received: from VA3EHSMHS008.bigfish.com (unknown [10.7.14.251]) by mail192-va3.bigfish.com (Postfix) with ESMTP id CA440E4804D for <oauth@ietf.org>; Thu, 11 Aug 2011 17:34:32 +0000 (UTC)
Received: from SN2PRD0302HT004.namprd03.prod.outlook.com (207.46.4.139) by VA3EHSMHS008.bigfish.com (10.7.99.18) with Microsoft SMTP Server (TLS) id 14.1.225.22; Thu, 11 Aug 2011 17:34:30 +0000
Received: from SN2PRD0302MB137.namprd03.prod.outlook.com ([169.254.5.250]) by SN2PRD0302HT004.namprd03.prod.outlook.com ([10.27.50.87]) with mapi id 14.01.0225.064; Thu, 11 Aug 2011 17:34:27 +0000
From: Anthony Nadalin <tonynad@microsoft.com>
To: "OAuth WG (oauth@ietf.org)" <oauth@ietf.org>
Thread-Topic: State Size
Thread-Index: AcxYRoAT8CIA/dQcQJeRV435yyBjnQ==
Date: Thu, 11 Aug 2011 17:34:26 +0000
Message-ID: <B26C1EF377CB694EAB6BDDC8E624B6E723B89B3C@SN2PRD0302MB137.namprd03.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [131.107.0.76]
Content-Type: multipart/alternative; boundary="_000_B26C1EF377CB694EAB6BDDC8E624B6E723B89B3CSN2PRD0302MB137_"
MIME-Version: 1.0
X-OrganizationHeadersPreserved: SN2PRD0302HT004.namprd03.prod.outlook.com
X-FOPE-CONNECTOR: Id%0$Dn%*$RO%0$TLS%0$FQDN%$TlsDn%
X-FOPE-CONNECTOR: Id%59$Dn%IETF.ORG$RO%2$TLS%6$FQDN%131.107.125.5$TlsDn%
X-OriginatorOrg: microsoft.com
X-CrossPremisesHeadersPromoted: TK5EX14MLTC101.redmond.corp.microsoft.com
X-CrossPremisesHeadersFiltered: TK5EX14MLTC101.redmond.corp.microsoft.com
Subject: [OAUTH-WG] State Size
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 11 Aug 2011 17:34:13 -0000
The spec states in multiple places that servers control how big authorization and other codes are so clients can't be sure how much space they will have in URIs. How can anyone design a client that is intended to work with multiple authorization servers if they have no clue how big their state can be? Are they supposed to re-write their state system every time they run into a protected resource that wants to use a bigger auth code then the client has expected them to? We have to give client developers some kind of guidance they can use to let them know what is a 'safe' size for their state so they can successfully implement with all authorization servers. Recommendation is to say something like - "we assume URIs can be at least 2Kb and that the total client provided values (e.g. the base redirect URI plus the state value) are no more than 1K."
- [OAUTH-WG] State Size Anthony Nadalin
- Re: [OAUTH-WG] State Size Eran Hammer-Lahav