hard20 pts · first answer countssecuritycryptography

Comparing secrets with ===

Why is checking a webhook signature or API key with if (provided === expected) a security risk?

A.=== converts both values to numbers before comparingB.Normal comparison stops at the first differing character, so timing leaks how much matchedC.=== compares UTF-16 code units, so a secret with non-ASCII characters can match a different, shorter valueD.=== ignores letter case, so many wrong values pass

← JWT verified with an attacker-chosen algorithm Retries stacked at every layer →