Expand description
Agent authentication: who is allowed to upload, and on whose behalf.
An agent presents a bearer token. The server stores only its SHA-256, so a database dump - or a stray log line containing a row - hands out nothing usable. Verification is a hash and a lookup, cheap enough to run on every upload.
SHA-256 rather than a password hash on purpose: these tokens are long random strings the server itself issues, not human-chosen secrets, so there is no dictionary to slow an attacker down with. Passwords, when they arrive with the login milestone, need a different treatment.
Structs§
- Authenticated
Agent - An authenticated agent and the person it reports for.
Functions§
- hash_
token - Hex-encoded SHA-256 of a token, which is what
agents.token_hashholds.