On 2010-05-16, at 5:20 PM, Manger, James H wrote: > Dick, > >> James: An important capability of the refresh token is that it *can* be a >> self contained token in that is not an id, but a signed token that can be >> examined and acted upon on presentation. > > Defining refresh_token as a URI does not prevent it being a self-contained > signed token. > > The only limitation implied is a URI size limit. A few KB, however, is not > that onerous a limit -- it is sufficient to hold a 4096-bit RSA signature > with a couple of KB over for permissions etc.).
Agreed, a token could be a self contained token. A design objective was allowing existing systems to use existing tokens. -- Dick _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
