thentos-cookie-session-0.9.0: All-in-one session handling for servant-based frontends

Safe HaskellNone
LanguageHaskell2010

Thentos.CookieSession.Types

Synopsis

Documentation

freshRandomName :: MonadRandom m => m ST Source

Return a base64 encoded random string of length 24 (18 bytes of entropy). We use _ instead of / as last letter of the base64 alphabet since it allows using names within URLs without percent-encoding. Our Base64 alphabet thus consists of ASCII letters + digits as well as + and _. All of these are reliably recognized in URLs, even if they occur at the end.

RFC 4648 also has a "URL Safe Alphabet" which additionally replaces + by -. But that's problematic, since - at the end of URLs is not recognized as part of the URL by some programs such as Thunderbird.