Re: [GNAP] Core protocol comments - Sec. 1-6

[Justin Richer <[e-mail]>]

Hi Yaron, I had one more note about this last point:




  *   6.1: Requiring an access token to be unexpired when it is rotated would simplify the text as well as the implementation logic (e.g. around expiration vs. revocation). Why not have the client responsible to rotate the token in a timely manner? If it doesn't, it can always request a new one.

This sounds great in practice, but that puts it on the client to proactively rotate the token before it needs to. In practice, what happens in the OAuth world is that a client wakes up, uses its token, sees a failure, then goes to try the refresh token to get a new access token.

That said, since we have the ability to get new access tokens from an existing grant, in addition to rotation, we could limit rotation to only “currently valid” tokens and sidestep the whole question. That is, if your token is still good then you can rotate it, but if it’s not you need a new one which might be from a grant continuation.

Even though this is a bit of a change I think it would help so I’m inclined to go in this direction.


I realized after thinking on this some more that this gets trickier with token revocation, which uses the same management system. You want a token revocation call to be idempotent — if you revoke a token that’s already dead, you still want to say “ok that’s fine” because the result is the same: the token can’t be used after the call. The only difference is that it couldn’t be used :before: the call either, but that’s immaterial to the action at hand.

Another alternative was brought up in this issue: https://github.com/ietf-wg-gnap/gnap-core-protocol/issues/485

Specifically, if there’s a separate token used to authorize the call to the token management endpoint, instead of using the token itself (plus whatever key binding is appropriate). This would parallel the grant management API, but it also seems a bit weird and complex, to me, to have a token used to manage a token. That said, it would get around the disconnect of allowing an expired token to be “used”.

 — Justin