softwaremill / akka-http-session

Web & mobile client-side akka-http sessions, with optional JWT support
https://softwaremill.com/open-source/
Apache License 2.0
440 stars 58 forks source link

hmac encoded csrf token #79

Closed willemvermeer closed 3 years ago

willemvermeer commented 3 years ago

Hi, this is a first iteration of a PR to resolve issue #77 I have provided a minimal implementation and am open to suggestions for improvement. For example, I decided to reuse the existing server secret to hash the timestamp, instead of defining a second server secret for this new purpose (personally I think it can do no harm to reuse the same server secret, but feel free to disagree, in which case we'll have to add config changes for an additional server secret). Best, Willem

adamw commented 3 years ago

Thank you! Released in 0.6.1