RequestStateCodec
FinalYes
Seals and verifies the opaque `requestState` carried across the rounds of a multi round-trip request (SEP-2322).
The value is base64url(payload).base64url(HMAC). It passes through the
client, so it is attacker-controlled on return and
self::verify() refuses anything whose MAC or expiry does not hold.
Signed, not encrypted: nothing secret belongs in the payload.
Tags
Table of Contents
Constants
- MINIMUM_KEY_BYTES : mixed = 32
- Below this the MAC — the only thing making the blob trustworthy — is forgeable.
- ALGORITHM : mixed = 'sha256'
Properties
- $key : string
- $ttlSeconds : int
Methods
- __construct() : mixed
- mint() : string
- verify() : array<string, mixed>
- decode() : string|null
- encode() : string
- sign() : string
Constants
MINIMUM_KEY_BYTES
Below this the MAC — the only thing making the blob trustworthy — is forgeable.
public
mixed
MINIMUM_KEY_BYTES
= 32
ALGORITHM
private
mixed
ALGORITHM
= 'sha256'
Properties
$key read-only
private
string
$key
$ttlSeconds read-only
private
int
$ttlSeconds
= 600
Methods
__construct()
public
__construct(string $key[, int $ttlSeconds = 600 ]) : mixed
Parameters
- $key : string
- $ttlSeconds : int = 600
mint()
public
mint(array<string, mixed> $payload[, int|null $now = null ]) : string
Parameters
- $payload : array<string, mixed>
-
server context to carry to the retry — never secrets
- $now : int|null = null
Return values
stringverify()
public
verify(string $state[, int|null $now = null ]) : array<string, mixed>
Parameters
- $state : string
- $now : int|null = null
Tags
Return values
array<string, mixed> —the payload that was sealed
decode()
private
static decode(string $encoded) : string|null
Parameters
- $encoded : string
Return values
string|nullencode()
private
static encode(string $raw) : string
Parameters
- $raw : string
Return values
stringsign()
private
sign(string $body) : string
Parameters
- $body : string