fix(auth): fixes possible timing attack in the token validation

2026-07-18 18:14:37 +02:00
parent 02e4462520
commit 536771d2bc
1 changed files with 5 additions and 1 deletions
@@ -1,3 +1,5 @@
+using System.Security.Cryptography;
+using System.Text;
 using ReverseLlama.Protocol;

 namespace ReverseLlama.Server;
@@ -115,7 +117,9 @@ internal static class TokenAuthentication
        }

        if (!string.IsNullOrWhiteSpace(settings.Token)
-            && string.Equals(token, settings.Token, StringComparison.Ordinal))
+            && CryptographicOperations.FixedTimeEquals(
+                SHA256.HashData(Encoding.UTF8.GetBytes(token)),
+                SHA256.HashData(Encoding.UTF8.GetBytes(settings.Token))))
        {
            return AuthResult.Success(null);
        }