Hi Justin,
thanks for your review. I incorporated your comments/proposals into a
new revision -03, which I just published
(http://tools.ietf.org/html/draft-ietf-oauth-revocation-03).
best regards,
Torsten.
Am 20.11.2012 16:58, schrieb Justin Richer:
Comments on the latest draft. Overall, it's in good shape, with a
little bit of tweaking to some of the new language I think it's about
ready for last call.
1. Introduction:
- "cleanup" as a verb should be two words here, "clean up"
- Remove extraneous commas, change
"This prevents a situation, where there is
still a valid access grant for that particular client,
which the end-
user is not aware of."
text to something more like:
"This behavior prevents a situation where there is
still a valid access grant for a particular client which
the end user is not aware of."
2. Token Revocation:
- grammatical parallelism, suggest wording:
"Implementations MUST support the revocation of refresh
tokens and
SHOULD support the revocation of access tokens."
- questionable whether the above is really a SHOULD, though I
understand Google's argument for this as detailed in the Note
- Consider moving the Note on access tokens to a Section and
including a cross-reference to it
- "It therefore validates..." reads awkwardly, suggest rewording with:
"These checks are used to validate whether the token
being presented
has been issued to the client presenting it."
3. Acknowledgements
- You don't need to list my middle initial, it sounds pretentious. ;)
5. Security Considerations
- "liklyhood" should be spelled "likelihood"
- countermeasures: make this a normative SHOULD? or MUST?
- "legitimate client to loss" should be "legitimate client to lose"
-- Justin
On 11/18/2012 11:40 AM, Torsten Lodderstedt wrote:
Hi,
the following changed were applied to the revocation draft:
- focused draft on client-initiated token revocation, cut out
self-care/portal stuff
- added implementation note on access token revocation.
- extended abstract
- removed normative language from introduction
regards,
Torsten.
Am 18.11.2012 17:37, schrieb internet-dra...@ietf.org:
A New Internet-Draft is available from the on-line Internet-Drafts
directories.
This draft is a work item of the Web Authorization Protocol
Working Group of the IETF.
Title : Token Revocation
Author(s) : Torsten Lodderstedt
Stefanie Dronia
Marius Scurtescu
Filename : draft-ietf-oauth-revocation-02.txt
Pages : 7
Date : 2012-11-18
Abstract:
This document proposes an additional endpoint for OAuth
authorization
servers, which allows clients to notify the authorization server
that
a previously obtained refresh or access token is no longer needed.
This allows the authorization server to cleanup security
credentials.
A revocation request will invalidate the actual token and, if
applicable, other tokens based on the same access grant.
The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-oauth-revocation
There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-oauth-revocation-02
A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-oauth-revocation-02
Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
