067e5403c4
All checks were successful
check / check (push) Successful in 4s
Hash client tokens with SHA-256 before storing in the database. When validating tokens, hash the incoming token and compare against the stored hash. This prevents token exposure if the database is compromised. Existing plaintext tokens are implicitly invalidated since they will not match the new hashed lookups. Changes: - Add hashToken() helper using crypto/sha256 - Hash tokens in CreateSession, RegisterUser, LoginUser before INSERT - Hash incoming token in GetSessionByToken before SELECT
23 KiB
23 KiB