<div dir="ltr"><div>Mike, do you have a recommendation for how to mitigate the drawbacks to that option that Nick discussed?</div><div><br></div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">
<div>
<div></div>
<div dir="ltr" style="color:rgb(0,0,0);font-family:Calibri,Helvetica,sans-serif">
<div dir="ltr" style="color:rgb(0,0,0);font-family:Calibri,Helvetica,sans-serif">
<p style="font-size:12pt;margin-top:0px;margin-bottom:0px"></p>
<p style="margin:0px;font-family:Calibri,Arial,Helvetica,sans-serif;font-weight:bold;padding:0px;line-height:14pt"><br></p><p style="margin:0px;font-family:Calibri,Arial,Helvetica,sans-serif;font-weight:bold;padding:0px;line-height:14pt"><br></p>
</div>
<div dir="ltr" style="font-size:12pt;color:rgb(0,0,0);font-family:Calibri,Helvetica,sans-serif">
<br>
</div>
</div>
</div>
</div></div></div><br></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Wed, Jun 18, 2025 at 7:47 PM Michael Jones via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<div>
<p><strong>This message originated outside your organization.</strong></p><br>
<hr><br>
</div>
<div style="font-family:Aptos,Aptos_MSFontService,-apple-system,Roboto,Arial,Helvetica,sans-serif;font-size:12pt" dir="auto">
Omit the claim.</div>
<div style="font-family:Aptos,Aptos_MSFontService,-apple-system,Roboto,Arial,Helvetica,sans-serif;font-size:12pt" dir="auto">
<br>
</div>
<div id="m_-1046615647844810323ms-outlook-mobile-body-separator-line" dir="auto"><br>
</div>
<div id="m_-1046615647844810323ms-outlook-mobile-signature" dir="auto" style="font-family:Aptos,Aptos_MSFontService,-apple-system,Roboto,Arial,Helvetica,sans-serif;font-size:12pt">
</div>
<hr style="display:inline-block;width:98%">
<div id="m_-1046615647844810323divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Openid-specs-ab <<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a>> on behalf of Nick Watson via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>><br>
<b>Sent:</b> Wednesday, June 18, 2025 2:20:44 PM<br>
<b>To:</b> <a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a> <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>><br>
<b>Cc:</b> Nick Watson <<a href="mailto:nwatson@google.com" target="_blank">nwatson@google.com</a>><br>
<b>Subject:</b> [Openid-specs-ab] Representation of infinite duration/timestamp</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div>Hi all,</div>
<div><br>
</div>
<div>Is there a recommended or canonical way to represent an infinite duration or timestamp? This has come up in a couple of contexts: (1) the session_lifetime claim in
<a href="https://urldefense.com/v3/__https://openid.net/specs/ipsie-openid-connect-sl1-profile-1_0.html*section-3.3.1-5__;Iw!!PwKahg!8SN2XVexavT6ox4IaR5XhGu4hSF07kT0qjLnxpo6VBysfpOjvJiUdWYJ1oXAj5Xwn3pFOH970B50GGKR2GBqayL7PQwbQNXT$" target="_blank">
IPSIE OIDC SL1</a>, e.g. for low-risk applications that can afford infinite sessions for convenience, and (2) an upcoming refresh token expiration spec I'm drafting.</div>
<div><br>
</div>
<div>There are a couple of options I'm considering:</div>
<div><br>
</div>
<div>1. Omit the field. The primary drawback here is that you can't distinguish between "no expiration" and "service doesn't support the spec". This option could potentially be coupled with mandatory updates to authz server metadata so that it's unambiguous
whether the server supports the spec.</div>
<div><br>
</div>
<div>2. Use ISO 8601 values with an additional "infinite" keyword. This is explicit but somewhat heavyweight (compared to ints), and existing 8601 parsers would need to be extended/wrapped to handle "infinite".</div>
<div><br>
</div>
<div>3. Use -1. This keeps fields numeric, but it's ugly and likely still requires special handling by clients.</div>
<div><br>
</div>
<div>4. Set arbitrary large values (order of years) and assume that's good enough. This is how cookies work, so there's some parallel there. The downside being that it doesn't really communicate what it intends, and some clients may end up implementing logic
like "a value larger than X indicates infinite".</div>
<div><br>
</div>
<div>Curious to hear the group's thoughts.</div>
<div><br>
</div>
<div>Nick</div>
<div><br>
</div>
<span>-- </span><br>
<div dir="ltr">
<div dir="ltr">
<div style="line-height:1.5em;padding-top:10px;margin-top:10px;color:rgb(85,85,85);font-family:sans-serif;font-size:small">
<span style="border-width:2px 0px 0px;border-style:solid;border-color:rgb(213,15,37);padding-top:2px;margin-top:2px">Nick
Watson |</span><span style="border-width:2px 0px 0px;border-style:solid;border-color:rgb(51,105,232);padding-top:2px;margin-top:2px"> Software
Engineer |</span><span style="border-width:2px 0px 0px;border-style:solid;border-color:rgb(0,153,57);padding-top:2px;margin-top:2px"> <a href="mailto:nwatson@google.com" target="_blank">nwatson@google.com</a> |</span><span style="border-width:2px 0px 0px;border-style:solid;border-color:rgb(238,178,17);padding-top:2px;margin-top:2px"> (781)
608-3352</span></div>
</div>
</div>
</div>
</div>
</div>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</blockquote></div>