Module token 

Opaque session tokens and their stored hashes.

A token is 32 bytes from the OS RNG, encoded as 43 characters of unpadded base64url. Nothing else is encoded in it. Only the SHA-256 of the token is ever stored, so a database leak does not leak usable cookies.

Structs

SessionToken

A freshly issued session token. The value is wiped from memory on drop and redacted from Debug output.

TokenHash

SHA-256 of a token. Comparison is constant-time.

Constants

TOKEN_LEN

Length of an encoded token in characters.

Functions

is_well_formed

Whether value has the shape of a token we issue: exactly 43 base64url characters.