Re: [OAUTH-WG] Indicating sites where a token is valid

Eran Hammer-Lahav <> Sun, 09 May 2010 21:30 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 015F93A69CE for <>; Sun, 9 May 2010 14:30:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.713
X-Spam-Status: No, score=-1.713 tagged_above=-999 required=5 tests=[AWL=-0.604, BAYES_05=-1.11, HTML_MESSAGE=0.001]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 2pFAN5RQxJy9 for <>; Sun, 9 May 2010 14:30:09 -0700 (PDT)
Received: from ( []) by (Postfix) with SMTP id 624C13A6917 for <>; Sun, 9 May 2010 14:30:09 -0700 (PDT)
Received: (qmail 18261 invoked from network); 9 May 2010 21:29:57 -0000
Received: from unknown (HELO ( by with SMTP; 9 May 2010 21:29:57 -0000
Received: from P3PW5EX1MB01.EX1.SECURESERVER.NET ([]) by P3PW5EX1HT002.EX1.SECURESERVER.NET ([]) with mapi; Sun, 9 May 2010 14:29:57 -0700
From: Eran Hammer-Lahav <>
To: "Manger, James H" <>, OAuth WG <>
Date: Sun, 9 May 2010 14:29:58 -0700
Thread-Topic: Indicating sites where a token is valid
Thread-Index: Acrtd+RKgxK8uGQ7RkCGWfcUzOTj/gCRtgSg
Message-ID: <90C41DD21FB7C64BB94121FBBC2E72343B3AB46E20@P3PW5EX1MB01.EX1.SECURESERVER.NET>
References: <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: multipart/alternative; boundary="_000_90C41DD21FB7C64BB94121FBBC2E72343B3AB46E20P3PW5EX1MB01E_"
MIME-Version: 1.0
Subject: Re: [OAUTH-WG] Indicating sites where a token is valid
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sun, 09 May 2010 21:30:11 -0000

Add some sort of wildcard support and I think this looks good.


From: [] On Behalf Of Manger, James H
Sent: Thursday, May 06, 2010 4:58 PM
To: OAuth WG
Subject: [OAUTH-WG] Indicating sites where a token is valid

The OAuth2 protocol does not indicate where a token can be used.
It needs to do so because if a client app sends a token to the wrong site it destroys the security.

I suggest another field in the JSON token response:
  "sites": ["", ""]

It would be a list of sites where the token can be used, specified by scheme://host[:port].

The default value for the “sites” field could be the token endpoint site (or the authorization endpoint site if a token endpoint isn’t used).
For instance, if Facebook’s new API uses for all resources, tokens, and authorizations it could omit the “sites” field.

P.S. I suggested this last month,  though I mixed in additional ideas for formats and media type that are probable best covered in their own treads.

James Manger