Timing attack on API key via String.equals() #65

Open

opened

Found via code audit. ApiKeyAuthFilter.java:76. Short-circuits on first diff byte. Use MessageDigest.isEqual().

Metadata

Assignees

No one assigned

Labels

No labels

No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests