Class TokenFingerprint
- Namespace
- Fdyay.IdentityServer.Events
- Assembly
- Fdyay.IdentityServer.Core.dll
What an event carries where Duende's carries a token: its SHA-256 fingerprint, never the token.
public static class TokenFingerprint- Inheritance
-
TokenFingerprint
- Inherited Members
Remarks
sha256: and the base64url SHA-256 of the token's UTF-8 bytes, without padding. Labelled in the value itself, so
a reader of a sink, which has no schema to hand, sees a fingerprint rather than something to try.
Ours, on purpose, by the decision of 2026-10-13. Duende 8.0.1's TokenIssuedSuccessEvent.Tokens carries
every issued token whole, and its revocation and introspection events carry the last four characters. A token in an
event sink is a credential in a log — RFC 9700's practice, OWASP's logging guidance, CWE-532 — and an event sink is
where a host sends things to a wider audience than its own logs. The property names and shapes are Duende's, so a
sink written against Duende compiles; the values are fingerprints, and there is no option that puts a token back.
A fingerprint still answers the questions an event is for: the same token always gives the same value, so a revocation or an introspection can be matched to the issuance that produced the token, and a host holding a token can compute its fingerprint here to find it. For a reference token or a refresh token the part after the label is also the key its stored grant is kept under.
Fields
Prefix
The label every fingerprint starts with.
public const string Prefix = "sha256:"Field Value
Methods
Compute(string?)
The fingerprint of token, or null when there is no token.
public static string? Compute(string? token)Parameters
tokenstring