feat: add timing safe equal comparison

* chore: add [email protected] as dependency * feat: add timing safe equal comparison Co-authored-by: Blake Embrey <[email protected]>
expressjs · Sep 30, 2024 · bac1e6a · bac1e6a
1 parent d3b6a63
commit bac1e6a
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 3 deletions.
diff --git a/index.js b/index.js
@@ -1,3 +1,4 @@
+var timingSafeCompare = require('tsscmp');
 var http = require('http');
 
 /*!
@@ -53,7 +54,9 @@ module.exports = function basicAuth(callback, realm) {
     if ('string' != typeof password) throw new Error('password argument required');
     realm = arguments[2];
     callback = function(user, pass){
-      return user == username && pass == password;
+      const usernameValid = timingSafeCompare(user, username);
+      const passwordValid = timingSafeCompare(pass, password);
+      return usernameValid && passwordValid;
     }
   }
 

diff --git a/package.json b/package.json
@@ -18,12 +18,15 @@
     "url": "https://github.com/expressjs/basic-auth-connect/issues"
   },
   "devDependencies": {
+    "connect": "*",
     "mocha": "*",
     "should": "*",
-    "supertest": "*",
-    "connect": "*"
+    "supertest": "*"
   },
   "scripts": {
     "test": "make test"
+  },
+  "dependencies": {
+    "tsscmp": "^1.0.6"
   }
 }