Changes between Version 39 and Version 40 of API_security

Timestamp:

08/15/2012 01:20:07 AM (10 months ago)

Author:

jbe

Comment:

Removed 'duration' and added 'single token'

API_security

@@ -36 +36 @@
 Applications running in the users web-browser (i.e. JavaScript applications) and non-interactive read-only API consumers are exempted from this refresh. Applications running in the users web-browser can't get long term access at all, but will require the user to authorize the application for every session. Non-interactive read-only API consumers refresh their access token by sending their client credentials.
 
-== Multiple authorizations per member for a single client ==
+== Optional invalidation of previously issued refresh tokens ==
 
-When authorizing a client, the user shall see any previously issued long-term authorizations for that client, which are still active. Any previous long-term authorization shall be revoked by default, thus invalidating previously issued refresh tokens for that client, unless the user explicitly agrees to a duplicate authorization (e.g. for multiple native clients on different smartphones). For manually registered clients, the behaviour regarding previously issued authorizations may be configured (field {{{code_grant_multiple}}} in table {{{api_client}}}), thus avoiding an interactive decision by the user.
+In case of using the OAuth authorization code grant, the API consumer may request to automatically invalidate previously issued refresh tokens to increase security, if only one refresh token per member is needed at a time. Do do this, the parameter 'single_token' can be set to true, when exchanging the authorization code for the access and refresh token.
 
 [[BR]]
@@ -51 +51 @@
 
  //scope// (string) The requested [[API#Accesslevels|access level]] (mandatory)
-
- //duration// (integer) How many seconds the OAuth authorization should be valid, 0 for infinity (optional)
 
  //state// (string) Passed value, which will be send back to the API consumer redirection endpoint, to be used for Cross Site Request Forgery protection (optional)
@@ -70 +68 @@
 
  //grant_type// (string) Always set to "authorization_code" (mandatory)
+
+ //single_token// (boolean) Set to true, if only one refresh token for a member is needed at a time.
 
  //client_id// (string) Set to the redirection endpoint URI of the API consumer (mandatory)