Re: [OAUTH-WG] Access Token Response without expires_in

Torsten Lodderstedt <> Tue, 17 January 2012 17:27 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id F3ABD11E8075; Tue, 17 Jan 2012 09:27:14 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.173
X-Spam-Status: No, score=-2.173 tagged_above=-999 required=5 tests=[AWL=0.075, BAYES_00=-2.599, HELO_EQ_DE=0.35, HTML_MESSAGE=0.001]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 5vvgjObX7Ans; Tue, 17 Jan 2012 09:27:14 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id 232A511E8072; Tue, 17 Jan 2012 09:27:13 -0800 (PST)
Received: from [] (helo=[]) by with esmtpsa (TLSv1:RC4-MD5:128) (Exim 4.68) (envelope-from <>) id 1RnCoR-0001LU-Mg; Tue, 17 Jan 2012 18:27:12 +0100
References: <90C41DD21FB7C64BB94121FBBC2E723453A754C549@P3PW5EX1MB01.EX1.SECURESERVER.NET> <> <> <> <>
User-Agent: K-9 Mail for Android
In-Reply-To: <>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----J9BMLS7DS5C14GN0QQCJ540HNT0I95"
From: Torsten Lodderstedt <>
Date: Tue, 17 Jan 2012 18:26:53 +0100
To: Paul Madsen <>
Message-ID: <>
X-Df-Sender: dG9yc3RlbkBsb2RkZXJzdGVkdC1vbmxpbmUuZGU=
Cc: OAuth WG <>,
Subject: Re: [OAUTH-WG] Access Token Response without expires_in
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 17 Jan 2012 17:27:15 -0000

Hi Paul,

that's not what I meant. The Client should know which tokens should be one time usage based on the API description. The authz server must not return expires_in because this would not make any sense in this case.


Paul Madsen <> schrieb:

Hi Torsten, yes the use case in question is payment-based as well. 

Your suggestion for the client to infer one-time usage from a missing expires_in contradicts the general consensus of this thread does it not?


On 1/17/12 11:38 AM, wrote: 

Hi, isn't one-time semantics typically associated with certain requests on certain resources/resource types. I therefore would assume the client to know which tokens to use one-time only. The authz server should not return an expires_in paramter. We for example use one time access tokens for payment transactions. What would such an extension specify? regards, Torsten. Gesendet mit BlackBerry® Webmail von Telekom Deutschland -----Original Message----- From: Paul Madsen <> Sender: Date: Tue, 17 Jan 2012 08:23:37 To: Richer, Justin P.<> Cc: OAuth WG<> Subject: Re: [OAUTH-WG] Access Token Response without expires_in _______________________________________________ OAuth mailing list