thentos

thentos copied to clipboard

Make thentos-the-lib polymorphic in Config

1

Issue #174 must be done before this. Just like with `ThentosError` and `DB`, a library user needs to be able to extend the configuration. some preliminary thoughts (copied from an...

fisx

Consider using the nonce package

3

We're currently using nonces for user confirmation tokens, email reset tokens, session tokens etc. These are generated by `genRandomBytes'P` from `Thentos.Action.Core`. There is a new-ish package called [nonce](https://hackage.haskell.org/package/nonce) on hackage...

fhartwig

Timing attack countermeasures

3

I've written down a simple idea that may help a great deal. We should implement it, if only because it's simple and because it'll make it easier to reason about...

mf59816