Documentation
¶
Overview ¶
Package tokenkey holds the key API token digests are made with (R-063).
An API token is stored as HMAC-SHA-256 of its secret under this key, so a database dump alone cannot be used to test a guess at any token: the key is in a file beside the process, not in Postgres. It is core's own key, not an adapter's — unlike the secrets key, no adapter can be swapped in for it.
Every replica on an install must hold the same key, which is why the file is created the same way the local secrets key is (several replicas on one shared volume end with one key) and why state.Tokens.VerifyKey checks it at start. A DR bundle carries it beside the secrets key (R-212); a restore without it makes every API token unusable.
Index ¶
Constants ¶
const DefaultPath = "/var/lib/pando/token.key"
DefaultPath is where the key lives unless server.token_key_path says otherwise: beside the secrets key, on the volume every replica shares.
const Size = 32
Size is the key length in bytes.
Variables ¶
This section is empty.
Functions ¶
func LoadOrCreate ¶
LoadOrCreate reads the key at path, generating it on first use.
Written 0600 beside the path and linked into place, which fails if a key is already there. Several replicas sharing one volume start at once, and two that each wrote their own key would each issue tokens the other could not verify; the one that loses the link reads the winner's instead (issue #72).
Types ¶
This section is empty.
Source Files