All projects
Project 03
BInsuredHere
Secure invitation lifecycle
I implemented the private invitation workflow, including random token generation, HMAC storage, expiry and validation, resend rotation, secure cookies, consent auditing, and atomic database consumption.
Visit live websiteCurrent public site; it may have changed since the work documented here.
Selected work
What I built
- Stored HMAC verifiers instead of raw invitation tokens.
- Rotated invitations on resend and enforced expiration.
- Used constant-time validation and secure cookie attributes.
- Made single-use consumption atomic with a conditional MySQL update.