Re: [OAUTH-WG] Defining a maximum token length?

  Is there some other natural parameter limit in place from HTTP?

Eliot

On 4/12/10 11:23 AM, Anthony Nadalin wrote:
>
> +1
>
> *From:* oauth-bounces@ietf.org [mailto:oauth-bounces@ietf.org] *On 
> Behalf Of *Torsten Lodderstedt
> *Sent:* Friday, April 09, 2010 11:57 PM
> *To:* Eran Hammer-Lahav
> *Cc:* OAuth WG
> *Subject:* Re: [OAUTH-WG] Defining a maximum token length?
>
> +1 no restriction, please
>
> 256 is much too short
>
> Am 10.04.2010 07:16, schrieb Eran Hammer-Lahav:
>
> I would argue that for the spec to provide a token size limit that is 
> greater than 255 would cause more harm than good. This is not to say I 
> am supporting the 255 limit (I take no position on the matter – yeah, 
> that happens rarely). If the spec provided a 4K limit, client 
> libraries are likely to codify that which will make them extremely 
> wasteful for 99% of the popular cases on the web today. A 4K limit 
> doesn’t really improve interop since the limit is so high, no one is 
> likely to issue even bigger tokens with public APIs.
>
> The 255 limit keeps the token size within the most effective database 
> field size limit for this type of identifier. If we cannot reach 
> consensus on this size limit, I don’t think the spec should say 
> anything. However, if I wrote a client library, I would make it use a 
> 255 default size limit and require a custom configuration to enable it 
> to use something else.
>
> So my proposal is 255 or no size guidance/restriction.
>
> EHL
>
>
> On 4/9/10 4:49 PM, "Allen Tom" <atom@yahoo-inc.com> wrote:
>
> I think a good precedent would be to use the HTTP Cookie size limit, which
> is 4KB.
>
> An OAuth Access Token is like an HTTP Authorization cookie. They're both
> bearer tokens that are used as a credentials for a client to access
> protected resources on behalf of the end user.
>
> All Oauth clients have to implement HTTP anyway, so 4KB sounds like a
> reasonable limit.
>
> Allen
>
>
>
> > On Fri, Apr 9, 2010 at 3:14 AM, Luke Shepard <lshepard@facebook.com> 
> wrote:
>
> >>
> >> So, what is a reasonable limit for the token length?  1k? 2k? 4k? 5mb? I
> >> suggest some language like this:
> >>
> >>
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>
>   
>   
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org  <mailto:OAuth@ietf.org>
> https://www.ietf.org/mailman/listinfo/oauth
>    
>
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth