Subject: Re: [OAUTH-WG] Defining a maximum token length?

From: [email-masked]
Date: Fri, 19 Mar 2010 13:44:13 +0100

Hi,

It appears that people agree excessive token length could be an issue 
for interoperability, but opinions vary on how long tokens 
could/should/must be. Relatively long tokens will occur when encoding 
data associated with the user (access rights, group memberships, etc.), 
and integrity protection / encryption techniques (relevant when tokens 
would be transmitted using plain HTTP) could also lead to long tokens.

Instead of agreeing/standardizing on a limit for token lengths, how 
about specifying a parameter in which the client declares the maximum 
token length it can accept? That way, at least potential interop 
problems due to long tokens can be detected; the Authentication server 
can subsequently return an error response if the token it would issue 
exceeds the client's max length

Regards,
Jeroen

---

From: Marius Scurtescu <[email-masked]>
Date: Sat, 20 Mar 2010 00:07:29 -0400

On Fri, Mar 19, 2010 at 8:44 AM,  <[email-masked]> wrote:
> Hi,
>
> It appears that people agree excessive token length could be an issue for
> interoperability, but opinions vary on how long tokens could/should/must be.
> Relatively long tokens will occur when encoding data associated with the
> user (access rights, group memberships, etc.), and integrity protection /
> encryption techniques (relevant when tokens would be transmitted using plain
> HTTP) could also lead to long tokens.
>
> Instead of agreeing/standardizing on a limit for token lengths, how about
> specifying a parameter in which the client declares the maximum token length
> it can accept? That way, at least potential interop problems due to long
> tokens can be detected; the Authentication server can subsequently return an
> error response if the token it would issue exceeds the client's max length

Why can't the client just check the length of the returned token and decide if
it can use it or not? Much simpler than adding one extra parameter and
error code.

Also, the authorization server could specify the length range for its tokens in
its documentation, so clients would know what to expect before implementing
any code.

Marius