Nightfirecat / RealmEye-API

An easy way to access your character data via RealmEye.
MIT License
13 stars 7 forks source link

Perform string comparison using hash_equals() #45

Closed Nightfirecat closed 7 years ago

Nightfirecat commented 7 years ago

It's timing-safe, and generally a better alternative to ==/=== or strcmp() as a result.

Places where this needs to change:

Nightfirecat commented 7 years ago

Given that the only 'sensitive' comparison is done in the deploy script, and it's already using hash_equals(), I'm inclined to say that the performance hit won't be worth it here. In general, most of the application doesn't have any security implications, so there's no real need for this.