Software/platform
1
1
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects Releases Wiki Activity

Replace password comparison with timingSafeEqual

Browse Source
This commit is contained in:
Dominic Ferrando
2026-07-18 00:34:07 -04:00
parent 33286282bb
commit 169034a63c
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/server.ts
+2 -1
View File
@@ -122,7 +122,8 @@ export const app = new Elysia()
// AUTHENTICATION // AUTHENTICATION
.post("/auth/login", async ({ jwt, body, cookie: { auth } }) => { .post("/auth/login", async ({ jwt, body, cookie: { auth } }) => {
if (body.password !== env.ADMIN_PASSWORD) throw status(401, "Invalid credentials"); const match = crypto.timingSafeEqual(Buffer.from(body.password, "hex"), Buffer.from(env.ADMIN_PASSWORD, "hex"));
if (!match) throw status(401, "Invalid credentials");
auth.set({ auth.set({
value: await jwt.sign({ sessionId: randomUUIDv7(), exp: JWT_EXP }), value: await jwt.sign({ sessionId: randomUUIDv7(), exp: JWT_EXP }),