keys

package

v0.1.0 Latest Latest Go to latest Published: Oct 14, 2026 License: Apache-2.0 Imports: 6 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/thasami/backyard

Links

Open Source Insights

Documentation ¶

Overview ¶

Package keys derives purpose-specific keys from server.secret so that a session key can never be used to forge an API token or an upload URL.

Index ¶

Constants
Variables
func Derive(secret, label string) []byte
func Sign(key, payload []byte) string
func Verify(key []byte, signed string) ([]byte, error)

Constants ¶

View Source

const (
	Session    = "backyard/session/v1"
	OAuthState = "backyard/oauth-state/v1"
	APIToken   = "backyard/api-token/v1"
	Deploy     = "backyard/deploy/v1"
	Upload     = "backyard/upload/v1"
	Anon       = "backyard/anon/v1"
	// CLIConfirm signs the confirmation form of a cross-site CLI login
	// (/__backyard/auth/cli). The value never leaves one deployment, so the
	// Cloudflare edition need not derive it identically.
	CLIConfirm = "backyard/cli-confirm/v1"
)

Labels for the derived keys. Every component must use its own label.

Variables ¶

View Source

var ErrBadSignature = errors.New("keys: bad signature")

ErrBadSignature is returned by Verify for malformed or forged values.

Functions ¶

func Derive ¶

func Derive(secret, label string) []byte

Derive returns a 32-byte key for label derived from secret with HKDF-SHA256.

func Sign ¶

func Sign(key, payload []byte) string

Sign returns base64url(payload) + "." + base64url(HMAC-SHA256(key, payload)).

func Verify ¶

func Verify(key []byte, signed string) ([]byte, error)

Verify checks a value produced by Sign and returns the payload.

Types ¶

This section is empty.

Source Files ¶

View all Source files

keys.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL