Module token 

Random bearer tokens: session cookies, one-time links, device cookies and CSRF tokens.

A token is 32 random bytes, base64url without padding (43 characters). The client gets the SecretToken; the app stores only its TokenHash (SHA-256), so a copy of the database does not hold usable tokens. Look a presented token up with TokenHash::of.

use latchkey::token::{self, TokenHash};

let mut rng = latchkey::os_rng()?;
let issued = token::issue(&mut rng);
let stored: TokenHash = issued.hash;
// Later, from the cookie the client sent back:
let presented = issued.token.expose_secret();
assert_eq!(TokenHash::of(presented), Some(stored));
assert!(stored.verify(presented));

Structs

IssuedToken

A freshly issued token and the hash to store for it.

SecretToken

A token to hand to the client once. Its Debug output is redacted, it has no Display, and it is zeroed when dropped.

TokenHash

The SHA-256 of a token: what the app stores and looks tokens up by.

Constants

TOKEN_BYTES

Random bytes in a token.

Functions

ct_eq

Compares two byte strings in constant time (for equal lengths).

issue

Issues a new random token.