valid_from / valid_to

[Paul Crowley]

Brad Fitzpatrick wrote:
> # openid.valid_from = UTC date
> # openid.valid_to = UTC date
> 
> What are those in the spec?

They define the validity period of the auth token according to the 
server clock.  The consumer should make the user re-authenticate when 
the token expires.  valid_from should be the creation date.

http://lists.danga.com/pipermail/yadis/2005-June/000559.html

defines how the consumer should conservatively track the server clock in 
ordre to interpret this expiry date.