What are the characteristics of an OAuth token?

Question

How many characters long can an oauth access token and oauth access secret be and what are the allowed characters? I need to store them in a database.

Answer 1

I am not sure there are any explicit limits. The spec doesn't have any. That said, OAuth tokens are often passed as url parameters and so have some of the same limitations. ie need to be properly encoded, etc.

Answer 2

OAuth doesn't specify the format or content of a token. We simply use encrypted name-value pairs as token. You can use any characters in token but it's much easier to handle if the token is URL-safe. We achieve this by encoding the ciphertext with an URL-safe Base64.

Answer 3

As most people already pointed out. The OAuth specification doesn't give you exact directions but they do say...

cited from: http://tools.ietf.org/html/draft-hammer-oauth-10#section-4.9

"Servers should be careful to assign shared-secrets which are long enough, and random enough, to resist such attacks for at least the length of time that the shared-secrets are valid."

"Of course, servers are urged to err on the side of caution, and use the longest secrets reasonable."

on the other hand, you should consider the maximum URL length of browsers:

see: http://www.boutell.com/newfaq/misc/urllength.html

Answer 4

If you read the spec, it says,

The authorization server issues the registered client a client
identifier - a unique string representing the registration
information provided by the client. The client identifier is not a
secret; it is exposed to the resource owner, and MUST NOT be used
alone for client authentication. The client identifier is unique to
the authorization server.

The client identifier string size is left undefined by this
specification. The client should avoid making assumptions about the
identifier size. The authorization server SHOULD document the size
of any identifier it issues.

Second, Access Token should be sent as header, not as a URL param.

Authorization: Bearer < token>.

Answer 5

An OAuth token is conceptually an arbitrary-sized sequence of bytes, not characters. In URLs, it gets encoded using standard URL escaping mechanisms:

  unreserved = ALPHA, DIGIT, '-', '.', '_', '~'

Everything not unreserved gets %-encoded.

I'm not sure whether you just talk about the oauth_token parameter that gets passed around. Usually, additional parameters need to be stored and transmitted as well, such as oauth_token_secret, oauth_signature, etc. Some of them have different data types, for example, oauth_timestamp is an integer representing seconds since 1970 (encoded in decimal ASCII digits).

Answer 6

Valid chars for OAuth token are limited by HTTP header value restrictions as OAuth token is frequently sent in HTTP header "Authorization".

Valid chars for HTTP headers are specified by https://tools.ietf.org/html/rfc7230#section-3.2.6. Alternatively you may check HTTP header validating code of some popular HTTP client libs, for example see Headers.checkNameAndValue() util of OkHttp framework: https://github.com/square/okhttp/blob/master/okhttp/src/main/java/okhttp3/Headers.java

And this is not all. I wouldn't include HTTP header separator (; and many others) and whitespace symbols (' ' and '\t') and double quote (") (see https://tools.ietf.org/html/rfc7230#section-3.2.6) as it would require to escape OAuth token before using in HTTP header. Frequently tokens are used by humans in curl test requests, and so good token generators don't add such characters. But you should check what characters may produce Oauth token generator with which your service is working before making any assumptions.

Answer 7

To be specific, even if Oauth spec doesn't say anything, if you are using java and mysql then it will be 16 characters as we generally generate the tokens using UUID and store it as BINARY(16) in the database. I know these details as I have recently done the development using OAuth.