Repository navigation
fix(server): compare the server password in constant time - #59167
benjaminkincses wants to merge 1 commit into
Conversation
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Looks good. I reproduced the timing leak from #58563 on the base with the bot's script: rejecting a 1 MiB guess that is wrong only in its last character cost ~23 µs vs ~4.5 µs for one wrong in its first character. With this change both cost the same. Passwords with multibyte characters (UTF-8 inputs of different byte lengths) don't throw, and a real opencode serve with Basic auth still accepts the right password and returns 401 for wrong ones. bun test test/auth.test.ts passes and tsc -b in packages/server is clean.
Public API: unchanged.
No blocking concerns. The equal-length check still reveals the password's length, which verifySession() already does. Hashing both sides before comparing would hide it, but that's optional.
Issue for this PR
Closes #58563
Type of change
What does this PR do?
the basic auth password check in
authorized()used===, so response timing leaks how much of a guessed password is right.verifySessionin the same file already usestimingSafeEqual. this makes the password check do the same (length check first, since timingSafeEqual throws on different lengths).How did you verify your code works?
added a case to packages/server/test/auth.test.ts covering wrong passwords of the same and different lengths.
bun test test/auth.test.tspasses (3 tests),tsc -bclean.Screenshots / recordings
Not a UI change.
Checklist