Re: [quicwg/base-drafts] NEW_TOKEN token and encryption (#2543)

[Dmitri Tikhonov <[e-mail]>]

I think the current text is fine:

```
   Unlike the token that is created for a Retry packet, there might be
   some time between when the token is created and when the token is
   subsequently used.  Thus, a token SHOULD include an expiration time.
   The server MAY include either an explicit expiration time or an
   issued timestamp and dynamically calculate the expiration time.  It
   is also unlikely that the client port number is the same on two
   different connections; validating the port is therefore unlikely to
   be successful.
```

"include" translates to "put into the token and encrypt" in my mind.  Reading that a token is "associated" with an expiration time would give me pause.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/2543#issuecomment-475401325