Security
Authentication & sessions
Tamanor uses opaque sessions with the token hashed in the database, supporting revocation, expiration and logout invalidation.
Opaque, revocable sessions
A session is an opaque token; the database stores only its hash, never the raw token. Sessions expire, can be revoked, and are invalidated on logout. Server-side checks enforce authentication on every protected route and action.
Frequently asked questions
- Is the raw session token stored?
- No — only a hash is stored, so the database never holds the usable token.