Re: [OAUTH-WG] Token expiration

As an example of what other APIs do, Amazon's S3 supports signed urls
of protected objects. The signed url is given a time to live after
which it's invalidated. It's specified in terms of number of seconds
from the time the url was generated. That's dependent on the clock of
the origin server I assume.

Unless there is considerable drift between clocks and a very short
time to live on the token, this shouldn't be a problem 99%+ of the
time I'd assume...

On Mon, Sep 21, 2009 at 3:22 PM, Chris Messina <chris.messina@gmail.com> wrote:
> Seems like it'd be worth documenting existing approaches to this... what do
> other similar APIs do?
> I know I harp on this approach to technology development, but that was how
> OAuth was developed (for better or worse): by looking at existing practices,
> extracting convention, and codifying ]ideally] best practices.
> If this is common and working elsewhere, can't we just imitate it?
> Chris
>
> On Mon, Sep 21, 2009 at 2:41 PM, Hubert Le Van Gong <hubertlvg@gmail.com>
> wrote:
>>
>> It is obviously useful to have. In fact it's so useful I'll bet most
>> token format
>> used do include one. Having it outside the token becomes redundant then
>> but
>> maybe it's not that bad.
>>
>> BTW why not using dateTime (http://www.w3.org/TR/xmlschema-2/#dateTime)?
>>
>> Cheers,
>> Hubert
>>
>>
>> On Mon, Sep 21, 2009 at 11:25 PM, Eran Hammer-Lahav <eran@hueniverse.com>
>> wrote:
>> > Should the core spec support the ability to indicate the duration of
>> > token credentials? This would be an addition to the web delegation draft [1]
>> > in section 6 (Token Credentials) in the form of a new response parameter,
>> > something like:
>> >
>> > oauth_token_duration
>> >    The token duration specified in second from the time of the HTTP
>> > response timestamp.
>> >
>> > This has been consistently at the top of missing core funcationality.
>> >
>> >
>> > EHL
>> >
>> > [1] http://tools.ietf.org/html/draft-ietf-oauth-web-delegation-01
>> >
>> > _______________________________________________
>> > OAuth mailing list
>> > OAuth@ietf.org
>> > https://www.ietf.org/mailman/listinfo/oauth
>> >
>> _______________________________________________
>> OAuth mailing list
>> OAuth@ietf.org
>> https://www.ietf.org/mailman/listinfo/oauth
>
>
>
> --
> Chris Messina
> Open Web Advocate
>
> Personal: http://factoryjoe.com
> Follow me on Twitter: http://twitter.com/chrismessina
>
> Citizen Agency: http://citizenagency.com
> Diso Project: http://diso-project.org
> OpenID Foundation: http://openid.net
>
> This email is:   [ ] shareable    [X] ask first   [ ] private
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>
>

-- 
Marcel Molina
Twitter Platform Team
http://twitter.com/noradio