CSRF token issuance and verification for state-changing requests.
Holds a token per session and exposes it for outgoing requests. Verification is
constant-time by construction — a comparison that short-circuits on the first differing
byte leaks the token's prefix through timing.
CSRF token issuance and verification for state-changing requests.
Holds a token per session and exposes it for outgoing requests. Verification is constant-time by construction — a comparison that short-circuits on the first differing byte leaks the token's prefix through timing.