search

seamapi / prefixed-api-key

Module for generating a prefixed API Key
MIT License
293 stars 13 forks source link

Use timing safe string comparison in `checkAPIKey` #11

Closed bencmbrook closed 1 year ago

bencmbrook commented 1 year ago

More about timing attacks here: https://security.stackexchange.com/questions/83660/simple-string-comparisons-not-secure-against-timing-attacks

bencmbrook commented 1 year ago

Closing in favor of https://github.com/seamapi/prefixed-api-key/pull/12 as I'm developing beyond this scope on my main branch