hashOpaqueToken function

String hashOpaqueToken(
  1. String token
)

Hashes an opaque authentication token for safe persistence.

Authentication tokens are generated with enough entropy that an unsalted SHA-256 digest is suitable for lookup. The digest is never used as a password verifier, and the random token remains the secret held by the client. Stores should persist this digest instead of the raw token.

Implementation

String hashOpaqueToken(String token) {
  return base64UrlNoPadding(sha256.convert(utf8.encode(token)).bytes);
}