Re: [OAUTH-WG] Draft progress update

Thu, 01 Apr 2010 12:32:55 -0700 


On 4/1/10 11:37 AM, "Marius Scurtescu" <[email protected]> wrote:

> SAML assertions contain the expiry inside, the OAuth "expires"
> parameter would be redundant, maybe this is way it is optional?

The token expiration doesn't have to be the same as the assertion.

> But, do we want to make this parameter required in general? Why not
> leave it optional for all flows? What if an Authorization Server
> implements some other mechanism to expire them (number of uses for
> example) and a fixed expiry time does not make sense?

The expiration parameter should be optional everywhere. If it is not, its
because I didn't get to it (or messed up).


EHL


_______________________________________________
OAuth mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/oauth























					Reply via email to