IETF Logo Mail Archive

Re: [OAUTH-WG] Refresh tokens

Brian Eaton <beaton@google.com> Wed, 15 June 2011 20:39 UTC

Return-Path: <beaton@google.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 72ADC11E812B for <oauth@ietfa.amsl.com>; Wed, 15 Jun 2011 13:39:30 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.976
X-Spam-Level:
X-Spam-Status: No, score=-105.976 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Zkt6FmOgF3BO for <oauth@ietfa.amsl.com>; Wed, 15 Jun 2011 13:39:29 -0700 (PDT)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by ietfa.amsl.com (Postfix) with ESMTP id B4D6111E809A for <oauth@ietf.org>; Wed, 15 Jun 2011 13:39:29 -0700 (PDT)
Received: from wpaz37.hot.corp.google.com (wpaz37.hot.corp.google.com [172.24.198.101]) by smtp-out.google.com with ESMTP id p5FKdSe3013332 for <oauth@ietf.org>; Wed, 15 Jun 2011 13:39:28 -0700
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1308170368; bh=FAV1BoNjbYTgi+d41a0FU0YDyY0=; h=MIME-Version:In-Reply-To:References:Date:Message-ID:Subject:From: To:Cc:Content-Type; b=JjoLqJkmgPTLKbmUVriOq1+gnTo26pQnXeCnNHtyDsQ6jaXMpCqR0QSv9Kmg5Mem2 X093CiFMUzay19ieUimkQ==
Received: from yib19 (yib19.prod.google.com [10.243.65.83]) by wpaz37.hot.corp.google.com with ESMTP id p5FKcRBx008262 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <oauth@ietf.org>; Wed, 15 Jun 2011 13:39:27 -0700
Received: by yib19 with SMTP id 19so606007yib.37 for <oauth@ietf.org>; Wed, 15 Jun 2011 13:39:27 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=o0rtiCm3c4U6iMK4X9VhXLzqPsFPr0CW8YH8kJqqju0=; b=kCyhDNKhKDEcY6+dYpbhRlnBChqI1koRaOaKjpOaDwMW+74kgZNoXlYOUYEQAeU+rX v07Aa5MblQsnGDW7KaPw==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=ucdBXh+jRX5VcpXshSW4ugAfYxzcfiGfKjVlW1jZ2/PmZNuw+ZMi0/GF2I04j0TRkU ksKKmILWLY2MwQXuVY6A==
MIME-Version: 1.0
Received: by 10.91.197.10 with SMTP id z10mr118677agp.143.1308170365905; Wed, 15 Jun 2011 13:39:25 -0700 (PDT)
Received: by 10.91.219.18 with HTTP; Wed, 15 Jun 2011 13:39:25 -0700 (PDT)
In-Reply-To: <1308169456.72680.YahooMailNeo@web31810.mail.mud.yahoo.com>
References: <90C41DD21FB7C64BB94121FBBC2E7234475E986AF9@P3PW5EX1MB01.EX1.SECURESERVER.NET> <BANLkTimVQL=4O3=L+et1XSx7-=h4Jnwd+g68siNqpMbSMn_wjA@mail.gmail.com> <1308169456.72680.YahooMailNeo@web31810.mail.mud.yahoo.com>
Date: Wed, 15 Jun 2011 13:39:25 -0700
Message-ID: <BANLkTi=-4rhzTP-wF2GowSrDyBRAXsnD1bN3uFM3XOSerf1Ddw@mail.gmail.com>
From: Brian Eaton <beaton@google.com>
To: "William J. Mills" <wmills@yahoo-inc.com>
Content-Type: multipart/alternative; boundary="00163676589bf72d1704a5c62564"
X-System-Of-Record: true
Cc: OAuth WG <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Refresh tokens
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 15 Jun 2011 20:39:30 -0000

Yeah, I agree with that change.

On Wed, Jun 15, 2011 at 1:24 PM, William J. Mills <wmills@yahoo-inc.com>wrote:

> I like your draft in general, but
>
>
>      10.1.3. Access Tokens
>
>      Access tokens are shorter-lived versions of refresh tokens.
>
> Doesn't work for me.  Access tokens are credentials used to access protected resources.  Refresh
> tokens are credentials used to obtain access tokens.
>
> -bill
>
>
> ------------------------------
> *From:* Brian Eaton <beaton@google.com>
> *To:* Eran Hammer-Lahav <eran@hueniverse.com>
> *Cc:* OAuth WG <oauth@ietf.org>
> *Sent:* Wednesday, June 15, 2011 11:32 AM
>
> *Subject:* Re: [OAUTH-WG] Refresh tokens
>
> On Wed, Jun 15, 2011 at 10:30 AM, Eran Hammer-Lahav <eran@hueniverse.com>wrote:
>
> I would like to add a quick discussion of access token and refresh token
> recommended deployment setup, providing clear guidelines when a refresh
> token SHOULD and SHOULD NOT be issued, and when issues, how it is difference
> from the access token.
>
>
> Is this a start?
>
> http://www.ietf.org/mail-archive/web/oauth/current/msg06362.html
>
>
> **
> It’s time we stop trying to accommodate every possible combination and make
> some hard choices.****
> **
>
>
> +1.  Yes please.
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>
>
>

v2.23.0 | Report a Bug | By Email