sessiontoken

package

v0.41.0 Latest Latest Go to latest Published: Jul 23, 2026 License: MIT Imports: 8 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/DonaldMurillo/gofastr

Links

Open Source Insights

Documentation ¶

Overview ¶

Package sessiontoken mints and verifies the stateless HMAC-signed tokens that replace the uihost's in-memory session map. A token is

sess-<128-bit random>.<unix-seconds>.<base64url HMAC-SHA256>

and carries no state beyond its own id and mint time, so any replica holding the same key accepts a token minted by any other — the multi-replica session contract (issue #112). The id portion ("sess-…") doubles as the SSE stream / presence key, exactly like the map-era session ids did.

Index ¶

func Mint(key []byte, now time.Time) (token, id string, err error)
func Verify(key []byte, token string, now time.Time, maxAge time.Duration) (id string, ok bool)

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func Mint ¶

func Mint(key []byte, now time.Time) (token, id string, err error)

Mint returns a signed token and the bare session id embedded in it.

func Verify ¶

func Verify(key []byte, token string, now time.Time, maxAge time.Duration) (id string, ok bool)

Verify authenticates token and returns its session id. maxAge bounds how old a token may be; tokens minted more than clockSkew in the future are rejected. Constant-time on the MAC comparison.

Types ¶

This section is empty.

Source Files ¶

View all Source files

token.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL