-
Notifications
You must be signed in to change notification settings - Fork 8
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ttl counting from iat rather than fetch time #274
Comments
That was a conscious decision to distribute the load for the hosting of the Status List. It is a SHOULD in the draft, so implementations may choose to not use the time of fetching + |
Thanks for confirming this was a conscious decision. That is currently not very clear from the draft itself. I agree that in general that would make a sensible default. Could I suggest alternatively to include a subsection under "implementation considerations"? |
Section 11.4 holds a description on caching status lists and expiry. The section contains a diagram, where the
ttl
is based of the time of fetching.The time of fetching can be rather arbitrary, e.g. first time of encountering of a token by an issuer in practice. A Relying Party may initially fetch a status list "just before
iat
". The RP will then have an outdated status list for the fullttl
, before again fetching the status list just before it will be renewed by the issuer.Typically the issuer of a token will publish a new status list every period (every
ttl
). This would be based off ofiat
, with the periodttl
. Hereby suggesting to revise the diagram, to base thettl
on theiat
rather than the "time of fetching". That way the Relying Party can get the most recent status list as soon as it is available.A downside may be that the issuer could see a load at or just after
iat
+ttl
. This however may happen in practice anyways, as it is typically a public endpoint.The text was updated successfully, but these errors were encountered: