I have a table for single use tokens, and one of the columns is a token_digest which contains a bcrypt hash of the access token. Since the token_digest is a salted and hashed version of the plaintext token, I can't just run a select against the computed hash.
When my application gets the plaintext token from a client, how can I find the correct token record from the database?
The only way I can think of solving this is by adding a prefix to the token that is stored in the database and isn't hashed. So you'd have something like
prefix9581d7b867eb0fe0da59fc98faa27fb8. Then you can find the token in the database by issuing a select with
where prefix = 'prefix'. Is this incorrect or an insecure solution?