Signed 30-day portal session

The portal issues an HMAC-signed 30-day session token scoped to one link, so a customer signs in once and never again.

What it is

CreateToken signs {linkId, viewerId, exp} with HMAC-SHA256 and a 30-day TTL. The browser caches it in localStorage under keys namespaced by link id, so one shared device can hold separate sessions for separate estimates. On return the page silently re-authenticates with the saved identity to refresh the full snapshot.

Also called: stay logged in · remember me · portal token

See it
Signed 30-day portal session
🔒ridgelinepostframe.com/project/portal386
30×40 Garage
Framing · on schedule
No visible UI; illustrate as a returning customer landing straight on their dashboard. Token logic in src/lib/clientPortalToken.ts. Sample data — no customer information appears here.
How it works
  1. 1auth mints body.signature, base64url, with a 30-day expiry
  2. 2localStorage stores cp_token, cp_viewer, cp_name and cp_email per link id
  3. 3On load the token is validated client-side, then re-authed server-side for fresh data
  4. 4verifyToken uses timingSafeEqual and rejects anything not signed
Why we built it

The session check accepted an older unsigned token format, which meant anyone could hand-craft a token with a distant expiry and be let in without the secret. A second bug let a token from one estimate bleed into another open in the same tab, rendering one customer's project data on another customer's page. Sessions are signed and scoped to a single link, and last 30 days, so a buyer comparing quotes over a fortnight is not re-identifying themselves at every visit.

The problem
  • Repeat sign-in friction on a link people revisit for months
  • A forgeable token that granted access without the secret
  • Cross-link data bleed on a shared browser
Sound familiar?
What you get
One sign-in lasts the length of a build
Tokens cannot be minted without the server secret
A token is refused unless its decoded link id matches the page

See it on your own jobs

Twenty minutes, your numbers, no slide deck. We’ll build one of your real buildings in front of you and send you the estimate link at the end — yours to keep either way.

or keep browsing features →