Package co.ankatech.ankasecure.sdk.security

Class BearerToken

java.lang.Object
co.ankatech.ankasecure.sdk.security.BearerToken
public final class BearerToken extends Object
Holder for a JWT bearer token represented as char[] rather than String, with a redacted toString() so accidental log statements do not leak the token verbatim.

The contract takes ownership of the supplied char[] — the caller must NOT retain a reference. Call clear() when the token is no longer needed; subsequent chars() calls throw IllegalStateException.

toString() returns:

  • "[REDACTED]" when the token has been cleared, or when the token's length is less than 10 (no useful prefix to display).
  • <first6>…[REDACTED] otherwise, where <first6> is the first six characters of the JWT (typically "eyJhbG" — the URL-safe base64 prefix of the JWS header).

clear() is idempotent.

  • Constructor Details

    • BearerToken

      public BearerToken(char[] owned)
      Takes ownership of the supplied char array.
      Throws:
      NullPointerException - if owned is null

  • Method Details

    • chars

      public char[] chars()
      Returns:
      the underlying token characters
      Throws:
      IllegalStateException - if clear() has been called

    • clear

      public void clear()
      Zeroizes the underlying token via Zeroization.zeroize(char[]) (space-fill). Idempotent. After this call, chars() throws and toString() returns "[REDACTED]".

    • isCleared

      public boolean isCleared()
      Returns:
      true if clear() has been called

    • toString

      public String toString()
      Returns a redacted representation of the token. Never reveals the full token value.
      Overrides:
      toString in class Object