hard20 pts · first answer countsweb-securitynodejscryptography

Comparing secret tokens safely

A webhook endpoint checks if (provided === process.env.API_KEY). You want to remove the timing side channel. Which approach is correct in Node.js?

A.Keep === and add a random sleep after each checkB.Hash both values (e.g. SHA-256) and compare the digests with crypto.timingSafeEqualC.Call crypto.timingSafeEqual on the raw strings; it returns false if the lengths differD.Convert both strings to lowercase before comparing

Discussion 0

Join free to post in the discussion.

Comparing secret tokens safely

Discussion 0

Related questions