Skip to content

Commit

Permalink
basic auth: fix timing oracle (#2609)
Browse files Browse the repository at this point in the history
Co-authored-by: thinkerou <thinkerou@gmail.com>
  • Loading branch information
Snawoot and thinkerou authored Jan 13, 2021
1 parent 46ddd42 commit b01605b
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion auth.go
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
package gin

import (
"crypto/subtle"
"encoding/base64"
"net/http"
"strconv"
Expand All @@ -30,7 +31,7 @@ func (a authPairs) searchCredential(authValue string) (string, bool) {
return "", false
}
for _, pair := range a {
if pair.value == authValue {
if subtle.ConstantTimeCompare([]byte(pair.value), []byte(authValue)) == 1 {
return pair.user, true
}
}
Expand Down

0 comments on commit b01605b

Please sign in to comment.