Monzo.Security (monzo_client v1.0.0)

Copy Markdown View Source

Small, dependency-free cryptographic helpers used by the OAuth2 flow: CSRF state token generation and constant-time comparison.

Summary

Functions

constant_time_equal?(a, b)

Compares two strings in constant time, for safely comparing a returned OAuth state value against the one you generated.

generate_state(byte_length \\ 32)

Returns a cryptographically random, URL-safe string suitable for use as the OAuth2 state parameter to protect against CSRF.

Functions

constant_time_equal?(a, b)

@spec constant_time_equal?(String.t(), String.t()) :: boolean()

Compares two strings in constant time, for safely comparing a returned OAuth state value against the one you generated.

generate_state(byte_length \\ 32)

@spec generate_state(pos_integer()) :: String.t()

Returns a cryptographically random, URL-safe string suitable for use as the OAuth2 state parameter to protect against CSRF.