The application secret: the key the session cookie is signed with.
One value, held once, read from EEZO_SECRET by default and overridden on HttpApp beside port. A class rather than a String so that it cannot be logged, compared with == on a clock, or handed where text is expected by mistake: toString redacts, equals compares in constant time, and the bytes are visible to the signer alone.
Signing is HMAC-SHA256, which every JDK is required to ship. A fresh Mac per call, because Mac is not thread safe and a handler runs on whichever virtual thread took the request.
It is reflexive: for any instance x of type Any, x.equals(x) should return true.
It is symmetric: for any instances x and y of type Any, x.equals(y) should return true if and only if y.equals(x) returns true.
It is transitive: for any instances x, y, and z of type Any if x.equals(y) returns true and y.equals(z) returns true, then x.equals(z) should return true.
If you override this method, you should verify that your implementation remains an equivalence relation. Additionally, when overriding this method it is usually necessary to override hashCode to ensure that objects which are "equal" (o1.equals(o2) returns true) hash to the same scala.Int. (o1.hashCode.equals(o2.hashCode)).
Value parameters
that
the object to compare against this object for equality.
Attributes
Returns
true if the receiver object is equivalent to the argument; false otherwise.
The default hashing algorithm is platform dependent.
Note that it is allowed for two objects to have identical hash codes (o1.hashCode.equals(o2.hashCode)) yet not be equal (o1.equals(o2) returns false). A degenerate implementation could always return 0. However, it is required that if two objects are equal (o1.equals(o2) returns true) that they have identical hash codes (o1.hashCode.equals(o2.hashCode)). Therefore, when overriding this method, be sure to verify that the behavior is consistent with the equals method.
