[E05-S02-T01] >=256-bit random raw token #236

New Issue

2026-08-27T00:17:17Z

kpcto commented

2026-08-27 00:17:17 +00:00

Parent story: [E05-S02] Opaque DB-backed session (#73)

Intent

Generate a random raw session token of at least 256 bits.

Acceptance criteria

Session token is a random raw value of at least 256 bits
Token generation uses a cryptographically secure random source

Explicitly out of scope

Lookup hash storage (E05-S02-T02)
Secure/HttpOnly/SameSite attributes (E05-S02-T03)
Logout revocation and expiration (E05-S02-T04/T05)
Admin API 401 to anonymous caller (E05-S02-T06)

Test plan

Automated test checks token entropy and length

Rollback note

Revert token generation change; existing sessions are re-issued

Owning stream

platform

Risk quadrant

agent-full

> Parent story: [E05-S02] Opaque DB-backed session (#73) ## Intent Generate a random raw session token of at least 256 bits. ## Acceptance criteria - Session token is a random raw value of at least 256 bits - Token generation uses a cryptographically secure random source ## Explicitly out of scope - Lookup hash storage (E05-S02-T02) - Secure/HttpOnly/SameSite attributes (E05-S02-T03) - Logout revocation and expiration (E05-S02-T04/T05) - Admin API 401 to anonymous caller (E05-S02-T06) ## Test plan - Automated test checks token entropy and length ## Rollback note - Revert token generation change; existing sessions are re-issued ### Owning stream platform ### Risk quadrant agent-full

kpcto added this to the Sprint 1 milestone 2026-08-27 00:17:17 +00:00

kpcto added the

labels 2026-08-27 00:17:17 +00:00

Sign in to join this conversation.