From 536771d2bc98fae98c06ca30b629cb030c584421 Mon Sep 17 00:00:00 2001
From: LD-Reborn <lucretia.dietz@gmx.de>
Date: Sat, 18 Jul 2026 18:14:37 +0200
Subject: [PATCH] fix(auth): fixes possible timing attack in the token
 validation

---
 src/ReverseLlama.Server/TokenAuthentication.cs | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/ReverseLlama.Server/TokenAuthentication.cs b/src/ReverseLlama.Server/TokenAuthentication.cs
index ac4199d..2e8c502 100644
--- a/src/ReverseLlama.Server/TokenAuthentication.cs
+++ b/src/ReverseLlama.Server/TokenAuthentication.cs
@@ -1,3 +1,5 @@
+using System.Security.Cryptography;
+using System.Text;
 using ReverseLlama.Protocol;
 
 namespace ReverseLlama.Server;
@@ -115,7 +117,9 @@ internal static class TokenAuthentication
         }
 
         if (!string.IsNullOrWhiteSpace(settings.Token)
-            && string.Equals(token, settings.Token, StringComparison.Ordinal))
+            && CryptographicOperations.FixedTimeEquals(
+                SHA256.HashData(Encoding.UTF8.GetBytes(token)),
+                SHA256.HashData(Encoding.UTF8.GetBytes(settings.Token))))
         {
             return AuthResult.Success(null);
         }