Class RefreshCredentialCodec

java.lang.Object

io.leandev.appfuse.security.auth.RefreshCredentialCodec

public final class RefreshCredentialCodec
extends Object

Opaque Refresh Credential 的產生與單向摘要 primitive。

明文採 rs1.<selector>.<verifier>：selector 與 verifier 都只交給 client，Store 僅保存各自的 SHA-256 hash。穩定、秘密的 selector 讓 Server 能找到 family 並辨識舊 verifier replay；它不可改用 Access Token 內可見的 session ID，否則知道 session ID 的人可偽造 credential 造成撤銷型 DoS。

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	RefreshCredentialCodec.IssuedCredential

Constructor Summary

Constructors

Constructor	Description
RefreshCredentialCodec()
RefreshCredentialCodec(SecureRandom secureRandom)

Method Summary

Modifier and Type	Method	Description
String	hash(String credential)
RefreshCredentialCodec.IssuedCredential	issue()
RefreshCredentialCodec.IssuedCredential	rotate(String currentCredential)	以同一個 family selector 產生下一個 verifier；legacy credential 首次輪替時建立新 selector。
Optional<String>	selectorHash(String credential)	從支援 replay detection 的 credential 取出 selector hash；legacy 無結構 credential 回 empty。

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

RefreshCredentialCodec

public RefreshCredentialCodec()

RefreshCredentialCodec

public RefreshCredentialCodec(SecureRandom secureRandom)

Method Details

issue

public RefreshCredentialCodec.IssuedCredential issue()

rotate

public RefreshCredentialCodec.IssuedCredential rotate(String currentCredential)

以同一個 family selector 產生下一個 verifier；legacy credential 首次輪替時建立新 selector。

selectorHash

public Optional<String> selectorHash(String credential)

從支援 replay detection 的 credential 取出 selector hash；legacy 無結構 credential 回 empty。

hash

public String hash(String credential)