CIBA: client_notification_token's length and usable characters

[Takahiko Kawasaki]

Regarding client_notification_token, it would be nice to mention its (minimum/maximum) length and usable characters (printable ASCII only or any characters).

A relevant discussion about nonce in the OpenID certification test suite is here:

https://github.com/openid-certification/oidctest/issues/134

[Dave Tonge]

@authlete-taka what values would you suggest for min / max?

[Brian Campbell]

General agreement on the 8/23 call for client_notification_token was:

• Add minimum entropy requirement/recommendation
• same allowable characters as access tokens (from https://tools.ietf.org/html/rfc6750#section-2.1)
• Define a maximum length (but long enough to allow for a reasonable sized JWT to be used as the client_notification_token)

[Brian Campbell]

pull request #31 has proposed changes to address this

[Brian Campbell]

merged pull request #31 with client_notification_token: add max length, allowed characters (via RFC6750 ref), and suggested min entropy or other protections (for issue #104)