d59da47220
The auth id is about to stand in for the game login's password verify, so it has to be a real bearer token. It was none of those things: drawn from Utility.Random (a non-cryptographic PRNG), tied to nothing, and expiring only when the 128-slot window filled, which on a quiet shard is never. It is now a CSPRNG draw across the whole int range, bound to the account and origin address that earned it, spent on presentation whether or not it vouches, and dead after two minutes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| Application | ||
| BuildTool | ||
| Logger | ||
| Server | ||
| Server.Tests | ||
| UOContent | ||
| UOContent.Tests | ||