Re: [OAUTH-WG] in-app logout?

"Manger, James H" <James.H.Manger@team.telstra.com> Mon, 17 May 2010 23:31 UTC

From: "Manger, James H" <James.H.Manger@team.telstra.com>
To: Yaron Goland <yarong@microsoft.com>
Date: Tue, 18 May 2010 09:31:29 +1000
Thread-Topic: [OAUTH-WG] in-app logout?
Thread-Index: AQHK8ozxzUROSzNgzEuStjakYvEI+5JP3EqAgAT+7wCAAGKqAIAAAaEAgACcEACAAG7RkA==
Message-ID: <255B9BB34FB7D647A506DC292726F6E112636107C3@WSMSG3153V.srv.dir.telstra.com>
References: <4BEBDCFB.7090503@lodderstedt.net> <255B9BB34FB7D647A506DC292726F6E11263465727@WSMSG3153V.srv.dir.telstra.com> <AANLkTikxD3jraqvG2IFmaSme0f1Q7NGPuQ3llqX3Ds5W@mail.gmail.com> <255B9BB34FB7D647A506DC292726F6E112634F5EA3@WSMSG3153V.srv.dir.telstra.com> <7934BAC5-7FA8-48E7-82A5-A4A17DE9146E@gmail.com> <7C01E631FF4B654FA1E783F1C0265F8C4A43095C@TK5EX14MBXC117.redmond.corp.microsoft.com>
In-Reply-To: <7C01E631FF4B654FA1E783F1C0265F8C4A43095C@TK5EX14MBXC117.redmond.corp.microsoft.com>
Accept-Language: en-US, en-AU
Content-Language: en-US
acceptlanguage: en-US, en-AU
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Cc: "OAuth WG (oauth@ietf.org)" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] in-app logout?
Precedence: list

Yaron,

> Note that in some very popular browsers and some proxies the maximum safe URL size is more like 2k.

2KB is sufficient for a 4096-bit RSA signature = 4096 / 8 * 4 / 3 = 683 base64 chars -- with 1.3KB over for permissions etc.


> -----Original Message-----
> From: oauth-bounces@ietf.org [mailto:oauth-bounces@ietf.org] On Behalf
> Of Dick Hardt
> Sent: Sunday, May 16, 2010 5:27 PM
> To: Manger, James H
> Cc: OAuth WG (oauth@ietf.org)
> Subject: Re: [OAUTH-WG] in-app logout?
> 
> 
> On 2010-05-16, at 5:20 PM, Manger, James H wrote:
> 
> > Dick,
> >
> >> James: An important capability of the refresh token is that it *can* be a
> self contained token in that is not an id, but a signed token that can be
> examined and acted upon on presentation.
> >
> > Defining refresh_token as a URI does not prevent it being a self-contained
> signed token.
> >
> > The only limitation implied is a URI size limit. A few KB, however, is not that
> onerous a limit -- it is sufficient to hold a 4096-bit RSA signature with a couple
> of KB over for permissions etc.).
> 
> Agreed, a token could be a self contained token. A design objective was
> allowing existing systems to use existing tokens.
> 
> -- Dick

[OAUTH-WG] in-app logout? Torsten Lodderstedt
Re: [OAUTH-WG] in-app logout? Manger, James H
Re: [OAUTH-WG] in-app logout? Dick Hardt
Re: [OAUTH-WG] in-app logout? Manger, James H
Re: [OAUTH-WG] in-app logout? Dick Hardt
Re: [OAUTH-WG] in-app logout? Yaron Goland
Re: [OAUTH-WG] in-app logout? Manger, James H
Re: [OAUTH-WG] in-app logout? Manger, James H
Re: [OAUTH-WG] in-app logout? Chasen Le Hara
Re: [OAUTH-WG] in-app logout? Hubert Le Van Gong
Re: [OAUTH-WG] in-app logout? Allen Tom
Re: [OAUTH-WG] in-app logout? Lukas Rosenstock
Re: [OAUTH-WG] in-app logout? Beau Lebens
Re: [OAUTH-WG] in-app logout? Hubert Le Van Gong
Re: [OAUTH-WG] in-app logout? Torsten Lodderstedt
Re: [OAUTH-WG] in-app logout? Igor Faynberg
Re: [OAUTH-WG] in-app logout? Eran Hammer-Lahav
Re: [OAUTH-WG] in-app logout? Torsten Lodderstedt
Re: [OAUTH-WG] in-app logout? Eran Hammer-Lahav
Re: [OAUTH-WG] in-app logout? Manger, James H
Re: [OAUTH-WG] in-app logout? Justin Richer
[OAUTH-WG] Fwd: Re: in-app logout? Torsten Lodderstedt
Re: [OAUTH-WG] in-app logout? Eran Hammer-Lahav
Re: [OAUTH-WG] Fwd: Re: in-app logout? Justin Richer
Re: [OAUTH-WG] Fwd: Re: in-app logout? George Fletcher