Re: [OAUTH-WG] Token expiration

Seems like it'd be worth documenting existing approaches to this... what do
other similar APIs do?
I know I harp on this approach to technology development, but that was how
OAuth was developed (for better or worse): by looking at existing practices,
extracting convention, and codifying ]ideally] best practices.

If this is common and working elsewhere, can't we just imitate it?

Chris

On Mon, Sep 21, 2009 at 2:41 PM, Hubert Le Van Gong <hubertlvg@gmail.com>wrote:

> It is obviously useful to have. In fact it's so useful I'll bet most
> token format
> used do include one. Having it outside the token becomes redundant then but
> maybe it's not that bad.
>
> BTW why not using dateTime (http://www.w3.org/TR/xmlschema-2/#dateTime)?
>
> Cheers,
> Hubert
>
>
> On Mon, Sep 21, 2009 at 11:25 PM, Eran Hammer-Lahav <eran@hueniverse.com>
> wrote:
> > Should the core spec support the ability to indicate the duration of
> token credentials? This would be an addition to the web delegation draft [1]
> in section 6 (Token Credentials) in the form of a new response parameter,
> something like:
> >
> > oauth_token_duration
> >    The token duration specified in second from the time of the HTTP
> response timestamp.
> >
> > This has been consistently at the top of missing core funcationality.
> >
> >
> > EHL
> >
> > [1] http://tools.ietf.org/html/draft-ietf-oauth-web-delegation-01
> >
> > _______________________________________________
> > OAuth mailing list
> > OAuth@ietf.org
> > https://www.ietf.org/mailman/listinfo/oauth
> >
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>

-- 
Chris Messina
Open Web Advocate

Personal: http://factoryjoe.com
Follow me on Twitter: http://twitter.com/chrismessina

Citizen Agency: http://citizenagency.com
Diso Project: http://diso-project.org
OpenID Foundation: http://openid.net

This email is:   [ ] shareable    [X] ask first   [ ] private