Re: [OAUTH-WG] Access Token Response without expires_in

William Mills <wmills@yahoo-inc.com> Tue, 17 January 2012 20:58 UTC

Return-Path: <wmills@yahoo-inc.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 261B721F8681 for <oauth@ietfa.amsl.com>; Tue, 17 Jan 2012 12:58:37 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -17.314
X-Spam-Level:
X-Spam-Status: No, score=-17.314 tagged_above=-999 required=5 tests=[AWL=0.284, BAYES_00=-2.599, HTML_MESSAGE=0.001, USER_IN_DEF_WHITELIST=-15]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RZsa86-8HcMt for <oauth@ietfa.amsl.com>; Tue, 17 Jan 2012 12:58:36 -0800 (PST)
Received: from nm30.bullet.mail.sp2.yahoo.com (nm30.bullet.mail.sp2.yahoo.com [98.139.91.100]) by ietfa.amsl.com (Postfix) with SMTP id 55A7021F868A for <oauth@ietf.org>; Tue, 17 Jan 2012 12:58:35 -0800 (PST)
Received: from [98.139.91.65] by nm30.bullet.mail.sp2.yahoo.com with NNFMP; 17 Jan 2012 20:58:32 -0000
Received: from [98.139.91.7] by tm5.bullet.mail.sp2.yahoo.com with NNFMP; 17 Jan 2012 20:58:32 -0000
Received: from [127.0.0.1] by omp1007.mail.sp2.yahoo.com with NNFMP; 17 Jan 2012 20:58:32 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 566642.64641.bm@omp1007.mail.sp2.yahoo.com
Received: (qmail 79848 invoked by uid 60001); 17 Jan 2012 20:58:32 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo-inc.com; s=ginc1024; t=1326833912; bh=5oyJxP/L4Y2HZEPhQ/rwYGo5tFfUniL77nqGFhsI0j4=; h=X-YMail-OSG:Received:X-RocketYMMF:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=KihL0BT03F6DZZYbkw8HuREPMScXLnoqQNdd2dHDRMazJJWWi5IRDJyLZOrIo/TXN4Z0gU1HzWhpK36Q4JxjUJLsowwgZ6rOcmQ96FOQ/5SRHS8bVr21iSFL72vrbPKpgiYZXI9qhN1qntZyp6DjRt6XLt8xH8FEuTnH6UCwlnw=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ginc1024; d=yahoo-inc.com; h=X-YMail-OSG:Received:X-RocketYMMF:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=hs1skGl3ROC0maF2buelmfvQpIS/T2UzxKGOZHxxrK7gmJpSfr1T2Wp0Kgkiwaeqzb5f6ETm8ZxIA95DRF4b/BKoR2xvQ8e1GxlV3Je/h3j6uBwLPnTB2qFe+zw7SRJJlNkassFE5/rULQmMXMQvD+Z4DGsChtRaIuICzCOcyKo=;
X-YMail-OSG: IkosR_YVM1mZczwsiplJ73Ij_gYnr6psXc09uZ5cy7nj84O aOqu.qSMAndwnhULJGxuH9DPk0nqWqWkQBx4Jjh5JdsKtaBrLTVrdBJu51Ai FCbVQlkJ04IteKn_xJ6ZtVeDR_lADZ7utbv.gpl4zEOXV6EcnmaW974S7MRl _sWp56axdo7.R6rvYPqnXCquN0RbooAaAyrsYFtWEOt3ANezNXijztWOs__6 pLJpWL5hfyp2WQ.IDqJTAfp0zJ6oo61kJWyv5b219ccESkQuNeVn_v3winMC LddjZ4kmAxDDKAp6e67eGgAWLsGjBItcu8q1UIJGCyVAGIOG.phz8FMB8zwa uUEOaOZ94IePEOdkadlOhibKu8EQBeDnajlLsAG3dkxHr.g.XQImFaz1wM2e QA.EypZx7b.enkEL39zRMMoSuIw4cjwvYjT.3ekQ-
Received: from [209.131.62.113] by web31813.mail.mud.yahoo.com via HTTP; Tue, 17 Jan 2012 12:58:32 PST
X-RocketYMMF: william_john_mills
X-Mailer: YahooMailWebService/0.8.116.331537
References: <90C41DD21FB7C64BB94121FBBC2E723453A754C549@P3PW5EX1MB01.EX1.SECURESERVER.NET> <E4309A9E-9BC7-4547-918A-224B6233B25C@mitre.org> <4F157659.7050701@gmail.com> <1451834425-1326818330-cardhu_decombobulator_blackberry.rim.net-253428785-@b4.c11.bise7.blackberry> <4F15A655.4060404@gmail.com>, <2fc6806a-8a15-4b97-87f2-3c0c0cbd3623@email.android.com> <B33BFB58CCC8BE4998958016839DE27E09EC78@IMCMBX01.MITRE.ORG>
Message-ID: <1326833912.76041.YahooMailNeo@web31813.mail.mud.yahoo.com>
Date: Tue, 17 Jan 2012 12:58:32 -0800
From: William Mills <wmills@yahoo-inc.com>
To: "Richer, Justin P." <jricher@mitre.org>, Torsten Lodderstedt <torsten@lodderstedt.net>, Paul Madsen <paul.madsen@gmail.com>
In-Reply-To: <B33BFB58CCC8BE4998958016839DE27E09EC78@IMCMBX01.MITRE.ORG>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="767760015-594162983-1326833912=:76041"
Cc: "oauth-bounces@ietf.org" <oauth-bounces@ietf.org>, OAuth WG <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Access Token Response without expires_in
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: William Mills <wmills@yahoo-inc.com>
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 17 Jan 2012 20:58:37 -0000


One use tokens can also expire before they are used.  "You have 5 minutes to do this once."



________________________________
 
From: Torsten Lodderstedt [torsten@lodderstedt.net]
Sent: Tuesday, January 17, 2012 12:26 PM
To: Paul Madsen
Cc: oauth-bounces@ietf.org; Richer, Justin P.; OAuth WG
Subject: Re: AW: Re: [OAUTH-WG] Access Token Response without expires_in


Hi Paul,

that's not what I meant. The Client should know which tokens should be one time usage based on the API description. The authz server must not return expires_in because this would not make any sense in this case.

regards,
Torsten





Paul Madsen <paul.madsen@gmail.com> schrieb: 
Hi Torsten, yes the use case in question is payment-based as well. 
>
>Your suggestion for the client to infer one-time usage from a missing expires_in contradicts the general consensus of this thread does it not?
>
>paul
>
>On 1/17/12 11:38 AM, torsten@lodderstedt.net wrote: 
>Hi, isn't one-time semantics typically associated with certain requests on certain resources/resource types. I therefore would assume the client to know which tokens to use one-time only. The authz server should not return an expires_in paramter. We for example use one time access tokens for payment transactions.   What would such an extension specify? regards,
Torsten.
Gesendet mit BlackBerry® Webmail von Telekom Deutschland   -----Original Message-----
From: Paul Madsen <paul.madsen@gmail.com> Sender: oauth-bounces@ietf.org Date: Tue, 17 Jan 2012 08:23:37 
To: Richer, Justin P.<jricher@mitre.org> Cc: OAuth WG<oauth@ietf.org> Subject: Re: [OAUTH-WG] Access Token Response without expires_in _______________________________________________
OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth 
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth