Replace password comparison with timingSafeEqual

2026-07-18 00:34:07 -04:00
parent 33286282bb
commit 169034a63c
1 changed files with 2 additions and 1 deletions
@@ -122,7 +122,8 @@ export const app = new Elysia()

    // AUTHENTICATION
    .post("/auth/login", async ({ jwt, body, cookie: { auth } }) => {
-        if (body.password !== env.ADMIN_PASSWORD) throw status(401, "Invalid credentials");
+        const match = crypto.timingSafeEqual(Buffer.from(body.password, "hex"), Buffer.from(env.ADMIN_PASSWORD, "hex"));
+        if (!match) throw status(401, "Invalid credentials");

        auth.set({
            value: await jwt.sign({ sessionId: randomUUIDv7(), exp: JWT_EXP }),