fix: use constant-time comparison for admin secret by lakhansamani · Pull Request #490 · authorizerdev/authorizer
Navigation Menu
{{ message }}
authorizerdev / authorizer Public
- Notifications You must be signed in to change notification settings
- Fork 204
Merged
fix: use constant-time comparison for admin secret#490
lakhansamani merged 3 commits intomainfrom
fix: use constant-time comparison for admin secret#490
lakhansamani merged 3 commits intomainfrom
Conversation
Copy link Copy Markdown
Contributor
lakhansamani
commented
Mar 1, 2026
lakhansamani
commented
Summary
- Replaced
secret == p.config.AdminSecretwithcrypto/subtle.ConstantTimeCompare - Prevents timing side-channel attacks on admin secret verification
Test plan
- Verify admin authentication still works correctly
- Verify invalid admin secrets are rejected
Fixes #479
lakhansamani added 3 commits
March 1, 2026 11:47Replaced direct string comparison with crypto/subtle.ConstantTimeCompare to prevent timing side-channel attacks on admin secret verification. Fixes #479
lakhansamani
merged commit
844dadd
into
main
lakhansamani
deleted the
fix/admin-secret-constant-time-compare
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
1 participant