Class OneTimeTokenService

java.lang.Object

com.codename1.backend.security.mail.OneTimeTokenService

public final class OneTimeTokenService
extends Object

Gives out tokens that work once: what a mailed link carries.

String token = tokens.create("invite", "ada@example.com", 3600);
// ... later, from the link
String username = tokens.consume("invite", token);   // null unless it is good

A token is 256 random bits, written in 43 characters that need no escaping in a URL. It is for one purpose and one user, stops working at its expiry and when it is used, and is replaced when the same user is given another for the same purpose. Only its SHA-256 is kept: whoever reads the table learns no token, and a token is looked up by that hash, so how long a lookup takes says nothing about a token that was guessed nearly right.

Constructor Summary

Constructors

Constructor	Description
OneTimeTokenService(OneTimeTokenRepository repository)

Method Summary

Modifier and Type	Method	Description
OneTimeTokenService	clock(Clock clock)	The clock expiry is measured by; a test sets its own.
String	consume(String purpose, String token)	Uses token up and answers the user it was given to, or null when it is not a token for purpose, has expired or was already used.
String	create(String purpose, String username, int validitySeconds)	A new token for username, good for validitySeconds and for purpose alone.
void	revoke(String purpose, String username)	Stops whatever token username holds for purpose from working.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

OneTimeTokenService

public OneTimeTokenService(OneTimeTokenRepository repository)

Method Details

clock

public OneTimeTokenService clock(Clock clock)

The clock expiry is measured by; a test sets its own.

create

public String create(String purpose,
 String username,
 int validitySeconds)

A new token for username, good for validitySeconds and for purpose alone. Any earlier token of that user and purpose stops working.

consume

public String consume(String purpose,
 String token)

Uses token up and answers the user it was given to, or null when it is not a token for purpose, has expired or was already used.

revoke

public void revoke(String purpose,
 String username)

Stops whatever token username holds for purpose from working.