1. class
  2. Core
  3. \
  4. Lib
  5. \
  6. Auth
  7. \
  8. RememberToken

RememberToken

final class RememberToken

Generates and hashes remember-me tokens. The raw token lives only in the user's cookie; only its hash is ever stored in user_sessions.

The pair works together: generate() mints a high-entropy raw token for the cookie, and hash() derives the value stored and looked up in the database. Because hash() is deterministic, auto-login can hash an incoming cookie token and match it against the stored hash with a single indexed query — while a leaked user_sessions table yields only hashes, not usable tokens. SHA-256 (rather than a slow password hash) is appropriate here precisely because the input is already high-entropy and the lookup must stay a fast, deterministic equality match.

Methods

static string
generate()

Generates a 256-bit token string.

static string
hash(string $token)

Generates a sha256 hash.

Details

at line 24
static string generate()

Generates a 256-bit token string.

Return Value

string

A new 256-bit token (raw — this goes in the cookie).

at line 34
static string hash(string $token)

Generates a sha256 hash.

Parameters

string $token

The raw token from the cookie.

Return Value

string

The value to store/look up in user_sessions.session.