coelho
commented
7 years ago Verify token is arbitrary per connection and is generated using "crypto/rand". There is also only one opportunity for the client to get the verify token right before disconnect, meaning even if leakage occurs, it doesn't matter. It's also 4 bytes, so good luck performing a timing attack on that when you're not localhost (and even if you are it's unreasonably difficult). I can't see the issue here and honestly your solution seems more prone to error.
Using bytes.Compare() could leak information about the system's state as the timing depends on how "correct" user-supplied input is.