search

delight-im / PHP-Auth

Authentication for PHP. Simple, lightweight and secure.
MIT License
1.08k stars 234 forks source link

Why use selector/token pair for password reset? #301

Open Luisparf opened 6 months ago

Luisparf commented 6 months ago

First of all, great library!

I'm building an application and I must document the database. So, I would like to know: why use a selector/token pair instead of just 1 token?

thanks a lot!

ocram commented 6 months ago

Thanks!

It’s split into two parts to protect against timing attacks. But it’s really just one pair with one meaning.

Actually, the two parts could even be joined together and be represented as just one piece for a developer using this library, and only be split again internally by this library.