token

package

v0.23.1 Latest Latest Go to latest Published: Oct 21, 2026 License: MIT Imports: 8 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/ShanilKoshitha/goforge

Links

Open Source Insights

Documentation ¶

Overview ¶

Package token issues and verifies opaque, database-backed security tokens.

Only the presented value contains the secret. Applications persist the selector and SHA-256 digest, deliver Presented to the user, and discard it after delivery. Parsing a presented value reproduces only the lookup selector and digest.

Index ¶

Variables
func MatchDigest(stored []byte, candidate Parsed) bool
type Issued
- func Issue() (Issued, error)
- func (issued Issued) Digest() []byte
type Issuer
- func NewIssuer(entropy io.Reader) Issuer
- func (issuer Issuer) Issue() (Issued, error)
type Parsed
- func Parse(presented string) (Parsed, error)
- func (parsed Parsed) Digest() []byte

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	// ErrInvalidToken is returned for every malformed token. It deliberately
	// carries no token fragments or parsing details.
	ErrInvalidToken = errors.New("token: invalid token")
)

Functions ¶

func MatchDigest ¶

func MatchDigest(stored []byte, candidate Parsed) bool

MatchDigest compares a stored digest with a parsed candidate in constant time. Invalid digest lengths never match, but still execute a full digest comparison.

Types ¶

type Issued ¶

type Issued struct {
	Selector  string
	Presented string
	// contains filtered or unexported fields
}

Issued contains the public selector, the digest to persist, and the complete value to deliver. Presented is the only returned value containing the secret.

func Issue ¶

func Issue() (Issued, error)

Issue creates a new token using crypto/rand.Reader.

func (Issued) Digest ¶

func (issued Issued) Digest() []byte

Digest returns a defensive copy of the SHA-256 digest to persist.

type Issuer ¶

type Issuer struct {
	// contains filtered or unexported fields
}

Issuer issues tokens from an explicit entropy source. Use Issue for the production crypto/rand path; an Issuer is primarily useful for deterministic tests or applications with their own cryptographic reader.

func NewIssuer ¶

func NewIssuer(entropy io.Reader) Issuer

NewIssuer constructs an issuer using entropy. A nil reader is rejected when Issue is called rather than silently falling back to another source.

func (Issuer) Issue ¶

func (issuer Issuer) Issue() (Issued, error)

Issue creates a new selector.secret token using the issuer's entropy source.

type Parsed ¶

type Parsed struct {
	Selector string
	// contains filtered or unexported fields
}

Parsed contains the public selector and derived digest of a presented token. It never retains or exposes the raw secret.

func Parse ¶

func Parse(presented string) (Parsed, error)

Parse validates the exact canonical selector.secret wire format and derives the digest used for database comparison. Every invalid input returns ErrInvalidToken without disclosing which part failed.

func (Parsed) Digest ¶

func (parsed Parsed) Digest() []byte

Digest returns a defensive copy of the digest derived during parsing.

Source Files ¶

View all Source files

token.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL