IETF Last Call Review of draft-ietf-oauth-status-list-13
review-ietf-oauth-status-list-13-artart-lc-levine-2025-11-23-00
| Request | Review of | draft-ietf-oauth-status-list |
|---|---|---|
| Requested revision | No specific revision (document currently at 21) | |
| Type | IETF Last Call Review | |
| Team | ART Area Review Team (artart) | |
| Deadline | 2025-11-11 | |
| Requested | 2025-10-21 | |
| Authors | Tobias Looker , Paul Bastian , Christian Bormann | |
| I-D last updated | 2026-08-13 (Latest revision 2026-06-21) | |
| Completed reviews |
Genart IETF Last Call review of -13
by Dale R. Worley
(diff)
Artart IETF Last Call review of -13 by John R. Levine (diff) |
|
| Assignment | Reviewer | John R. Levine |
| State | Completed | |
| Request | IETF Last Call review on draft-ietf-oauth-status-list by ART Area Review Team Assigned | |
| Posted at | https://mailarchive.ietf.org/arch/msg/art/xsiOPSAO1dMnbg2IrgA5xbTiWG4 | |
| Reviewed revision | 13 (document currently at 21) | |
| Result | Ready | |
| Completed | 2025-11-23 |
review-ietf-oauth-status-list-13-artart-lc-levine-2025-11-23-00
While I am familiar with the bits of technology this draft uses, I am not very familiar with the whole token ecosystem, so this review is somewhat like one written by a reviewer who arrived during the third act of a five act opera. The description of the various encodings and embeddings are clear enough, and the discussions of threats, particularly using huge sets of status items to keep publishers from knowing which item you're looking for, makes sense.