Hash stored for a code: an HMAC-SHA-256 under a SERVER-ONLY key, salted and bound to the session so
equal codes never hash equal.
The key is what makes this safe. A code is only six digits, and the session's owner — the very person
being verified — can read their own Session.Config, hash and salt included. A plain (even salted)
hash would let them recover the code offline in about a million guesses without ever opening the
inbox, bypassing the attempt cap entirely. Without the key the stored value is useless to a reader.
Parameters
code: string
the normalised six-digit code
salt: string
the per-verification salt stored beside the hash
agentSessionId: string
the session the code is bound to
key: string
the server-only key (realtime.identityVerification.hmacSecret); must be non-empty
Hash stored for a code: an HMAC-SHA-256 under a SERVER-ONLY key, salted and bound to the session so equal codes never hash equal.
The key is what makes this safe. A code is only six digits, and the session's owner — the very person being verified — can read their own
Session.Config, hash and salt included. A plain (even salted) hash would let them recover the code offline in about a million guesses without ever opening the inbox, bypassing the attempt cap entirely. Without the key the stored value is useless to a reader.