In different token, for example SAML, I have encountered I have seen that it includes the timestamp for when it was created. I understand the reason for a expiration timestamp, but before the token is created it doesnt exist so I dont understand the reason for it.

Ideas. It gives possibility for the receiver to specify expiration time It takes unsynchronized machine time into account


Often I've used the created timestamp as a way of proving uniqueness. The general assumption is that the granularity of the timestamp will be unique enough that a given receiver can assume that only one request with the timestamp or with a unique value that includes the timestamp will be received.

That would prevent some forms of replay attack, where an attacker gets a copy of an authenticated request and replays it at a later time to get updated information without having the necessary credentials.

  • It seems lik a non standard way of ensuring uniqueness. Do you think the point of the created date is for uniqueness? One could also just use the exiration timestamp – Stefan Rasmusson Nov 20 '13 at 7:19
  • One can use a lot of things - it depends on the specifics and the rules of expiration. For example, if your rule is "all things made today expire at midnight" then expiration is in no way unique. If the rules is "set expiration to 5 seconds after creation time according to the local server" - then creation and expiration will be very similar in uniqueness. – bethlakshmi Nov 20 '13 at 14:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.