[OAUTH-WG] Message ID for draft-jones-oauth-jwt-bearer

John Bradley <ve7jtb@ve7jtb.com> Thu, 24 November 2011 01:01 UTC

Return-Path: <ve7jtb@ve7jtb.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost []) by ietfa.amsl.com (Postfix) with ESMTP id EB6CD11E80B5 for <oauth@ietfa.amsl.com>; Wed, 23 Nov 2011 17:01:58 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.502
X-Spam-Status: No, score=-3.502 tagged_above=-999 required=5 tests=[AWL=0.096, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id l8a1FlMlXXhY for <oauth@ietfa.amsl.com>; Wed, 23 Nov 2011 17:01:58 -0800 (PST)
Received: from mail-yw0-f44.google.com (mail-yw0-f44.google.com []) by ietfa.amsl.com (Postfix) with ESMTP id 068AE11E8089 for <oauth@ietf.org>; Wed, 23 Nov 2011 17:01:57 -0800 (PST)
Received: by ywt34 with SMTP id 34so2365847ywt.31 for <oauth@ietf.org>; Wed, 23 Nov 2011 17:01:57 -0800 (PST)
Received: by with SMTP id d63mr38952288yhn.73.1322096514994; Wed, 23 Nov 2011 17:01:54 -0800 (PST)
Received: from [] ([]) by mx.google.com with ESMTPS id x20sm1881389yhe.13.2011. (version=TLSv1/SSLv3 cipher=OTHER); Wed, 23 Nov 2011 17:01:54 -0800 (PST)
From: John Bradley <ve7jtb@ve7jtb.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_8A684F5E-5236-4929-B2E4-367ABECE8974"
Date: Wed, 23 Nov 2011 22:01:50 -0300
Message-Id: <FF3DAF17-D2AF-4E02-AC4B-CDBCA1FE73FE@ve7jtb.com>
To: oauth WG <oauth@ietf.org>
Mime-Version: 1.0 (Apple Message framework v1251.1)
X-Mailer: Apple Mail (2.1251.1)
Subject: [OAUTH-WG] Message ID for draft-jones-oauth-jwt-bearer
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Nov 2011 01:01:59 -0000

The draft-jones-oauth-jwt-bearer profile is lacking a message ID that exists in the SAML version.

This is important for the receiver to detect replay attacks.

For Connect I made up a claim to use:

tid  The tid (token id) claim, A nonce or unique identifier for the assertion. The Assertion ID may be used by implementations requiring message de- duplication for one-time use assertions.

I was tempted to use mid (Message ID) however it is the id of the token not the message.

If you add something I will change the claim to be consistent.

I think it needs to be in your spec.

John B.