search

LionC / express-basic-auth

Plug & play basic auth middleware for express
325 stars 57 forks source link

Changed '&' operator to '&&' for boolean compare #56

Closed joaqim closed 9 months ago

joaqim commented 1 year ago

If this is intended - though I can't see why - there should be a comment explicitly mentioning it.

LionC commented 9 months ago

It is explicitly mentioned in the docs for users. The reason is that comparison with && is vulnerable to timing attacks because it short circuits.