Download the PHP package arraypress/wp-signed-tokens without Composer
On this page you can find all versions of the php package arraypress/wp-signed-tokens. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download arraypress/wp-signed-tokens
More information about arraypress/wp-signed-tokens
Files in arraypress/wp-signed-tokens
Package wp-signed-tokens
Short Description HMAC-signed, expiring, namespaced tokens for URLs. Download links, magic sign-in, password resets and unsubscribe links with no database row.
License GPL-2.0-or-later
Homepage https://github.com/arraypress/wp-signed-tokens/
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package wp-signed-tokens
WordPress Signed Tokens
Tokens you can put in a URL that expire, cannot be forged, and cannot be reused somewhere else.
What it does
A download link, a magic sign-in, an unsubscribe URL — all the same shape. Put something in a URL, and later trust that you put it there and that it has not expired.
Doing it by hand usually means an md5() of some values and a database row to
check against. This signs the payload with HMAC instead, so there is nothing to
look up, and compares in constant time so the signature cannot be guessed a
byte at a time.
The namespace is the part people leave out: a token signed for download will
not verify as a token for login, even with the same secret.
Features
- Sign a payload into a compact, URL-safe token
- Namespaced, so a token for one purpose cannot be replayed at another
- Expires on its own — no cleanup job, no database row
- Constant-time comparison, so signatures cannot be brute-forced by timing
- Derives its secret from the site's own salts, or takes one you supply
- Tells you why a token failed — expired, wrong namespace, tampered with
- Detached signatures, for when the payload travels separately
Installation
Quick start
Requirements
- PHP 8.3 or later
- WordPress 7.1 or later
License
GPL-2.0-or-later
