In section 2.1 of the OAuth2.0 RFC, it states the following regarding the client identifier:

The authorization server SHOULD document the size of any identifier it issues.

What is the point of doing this?

1 Answer 1


Some identifiers may be stored in a database or another format which specifies the size of fields.

It would be a pretty common case where a developer wanted to store authorization tokens in their database. Here's a real world example.

In the case I linked above, the token used to be under 255 characters, which would fit in a VARCHAR(255), but Facebook has been sending access tokens with more than 255 characters.

This may not seem like much of an issue, because a developer could set their varchar to 8000 or whatever their DB max size is, but in some MySql instances, having a UTF-8 VARCHAR over 255 can lead to issues indexing the tables.

There's a lot of nuances that could inform design decisions, if the developers know what they're going to be getting back from a authorization server, and if it changes, it's better to have that documented somewhere, rather than just have it fail one day and have no idea what happened.

You must log in to answer this question.