Expand description
Session tokens.
In-memory, and that is a 0.1.0 limitation with consequences worth stating rather than
discovering. Upstream stores sessions in the _Session class, so they survive a restart and
are visible to every node. This store does neither: restarting the server logs everyone out,
and two parse-rust processes do not share sessions.
That is acceptable for a proof of concept and unacceptable beyond it. It is recorded in the release notes rather than left implicit, because “sessions work” and “sessions work on one process until it restarts” look identical in a demo.
The token format is not a shortcut: r: plus a 32-character random string is what upstream
generates, and clients treat the prefix as meaningful.