[remy_]

The authentication token follows a very specific pattern to prevent this type of attacks. For example an authentication token would look like this: gpgauthv1.3.0|36|8661be60-23df-11e5-b16c-0002a5d5c51b|gpgauthv1.3.0. Both the server and client check for the consistency of that format.

[sweis]

Got it. Here's the code: https://github.com/passbolt/passbolt/blob/master/app/Control...

I didn't know gpgauth existed, but this is what they appear to be using (the site has a broken cert): https://gpgauth.org/