IETF Logo Mail Archive

Re: [OAUTH-WG] Defining a maximum token length?

Anthony Nadalin <tonynad@microsoft.com> Mon, 12 April 2010 09:24 UTC

Return-Path: <tonynad@microsoft.com>
X-Original-To: oauth@core3.amsl.com
Delivered-To: oauth@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9EA6F3A6949 for <oauth@core3.amsl.com>; Mon, 12 Apr 2010 02:24:27 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.598
X-Spam-Level:
X-Spam-Status: No, score=-10.598 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sXTCCSTCaxHO for <oauth@core3.amsl.com>; Mon, 12 Apr 2010 02:24:22 -0700 (PDT)
Received: from smtp.microsoft.com (mail1.microsoft.com [131.107.115.212]) by core3.amsl.com (Postfix) with ESMTP id BFA753A6A36 for <oauth@ietf.org>; Mon, 12 Apr 2010 02:23:20 -0700 (PDT)
Received: from TK5EX14MLTC102.redmond.corp.microsoft.com (157.54.79.180) by TK5-EXGWY-E801.partners.extranet.microsoft.com (10.251.56.50) with Microsoft SMTP Server (TLS) id 8.2.176.0; Mon, 12 Apr 2010 02:23:15 -0700
Received: from TK5EX14MBXC103.redmond.corp.microsoft.com ([169.254.3.164]) by TK5EX14MLTC102.redmond.corp.microsoft.com ([157.54.79.180]) with mapi; Mon, 12 Apr 2010 02:23:14 -0700
From: Anthony Nadalin <tonynad@microsoft.com>
To: Torsten Lodderstedt <torsten@lodderstedt.net>, Eran Hammer-Lahav <eran@hueniverse.com>
Thread-Topic: [OAUTH-WG] Defining a maximum token length?
Thread-Index: AQHKv+NqeBNkDGZuLk6fvcZcrhAM6pIakGKAgACWUgD//6iHcIAAL6wxgABbIo6AAJGGgIAC2DEA
Date: Mon, 12 Apr 2010 09:23:14 +0000
Message-ID: <A08279DC79B11C48AD587060CD93977125EFFC84@TK5EX14MBXC103.redmond.corp.microsoft.com>
References: <C7E557A0.32014%eran@hueniverse.com> <4BC02133.70209@lodderstedt.net>
In-Reply-To: <4BC02133.70209@lodderstedt.net>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Content-Type: multipart/alternative; boundary="_000_A08279DC79B11C48AD587060CD93977125EFFC84TK5EX14MBXC103r_"
MIME-Version: 1.0
Cc: OAuth WG <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Defining a maximum token length?
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 12 Apr 2010 09:24:27 -0000

+1

From: oauth-bounces@ietf.org [mailto:oauth-bounces@ietf.org] On Behalf Of Torsten Lodderstedt
Sent: Friday, April 09, 2010 11:57 PM
To: Eran Hammer-Lahav
Cc: OAuth WG
Subject: Re: [OAUTH-WG] Defining a maximum token length?

+1 no restriction, please

256 is much too short

Am 10.04.2010 07:16, schrieb Eran Hammer-Lahav:
I would argue that for the spec to provide a token size limit that is greater than 255 would cause more harm than good. This is not to say I am supporting the 255 limit (I take no position on the matter - yeah, that happens rarely). If the spec provided a 4K limit, client libraries are likely to codify that which will make them extremely wasteful for 99% of the popular cases on the web today. A 4K limit doesn't really improve interop since the limit is so high, no one is likely to issue even bigger tokens with public APIs.

The 255 limit keeps the token size within the most effective database field size limit for this type of identifier. If we cannot reach consensus on this size limit, I don't think the spec should say anything. However, if I wrote a client library, I would make it use a 255 default size limit and require a custom configuration to enable it to use something else.

So my proposal is 255 or no size guidance/restriction.

EHL


On 4/9/10 4:49 PM, "Allen Tom" <atom@yahoo-inc.com> wrote:
I think a good precedent would be to use the HTTP Cookie size limit, which
is 4KB.

An OAuth Access Token is like an HTTP Authorization cookie. They're both
bearer tokens that are used as a credentials for a client to access
protected resources on behalf of the end user.

All Oauth clients have to implement HTTP anyway, so 4KB sounds like a
reasonable limit.

Allen



> On Fri, Apr 9, 2010 at 3:14 AM, Luke Shepard <lshepard@facebook.com> wrote:

>>
>> So, what is a reasonable limit for the token length?  1k? 2k? 4k? 5mb? I
>> suggest some language like this:
>>
>>

_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth





_______________________________________________

OAuth mailing list

OAuth@ietf.org<mailto:OAuth@ietf.org>

https://www.ietf.org/mailman/listinfo/oauth

v2.23.0 | Report a Bug | By Email