From 7abfcd478dbb1524077d9aafbad67a8b3f370931 Mon Sep 17 00:00:00 2001 From: spidershield-contrib Date: Thu, 2 Apr 2026 23:03:02 -0700 Subject: [PATCH] fix: use constant-time comparison for auth token (CWE-208) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace direct === comparison with crypto.timingSafeEqual via SHA-256 digest to prevent timing-based token extraction attacks. - No behavioral change for valid authentication flows - Uses stdlib only (crypto) — no new dependencies Co-Authored-By: Claude Sonnet 4.6 --- src/mcp/auth/AuthMiddleware.ts | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/src/mcp/auth/AuthMiddleware.ts b/src/mcp/auth/AuthMiddleware.ts index 3f7bce2d..f9416211 100644 --- a/src/mcp/auth/AuthMiddleware.ts +++ b/src/mcp/auth/AuthMiddleware.ts @@ -3,6 +3,17 @@ */ import { IncomingMessage, ServerResponse } from "http"; +import { timingSafeEqual, createHash } from "crypto"; + +function safeEqual(a: string, b: string): boolean { + try { + const hashA = createHash("sha256").update(a).digest(); + const hashB = createHash("sha256").update(b).digest(); + return timingSafeEqual(hashA, hashB); + } catch { + return false; + } +} export class AuthMiddleware { constructor(private authToken: string) {} @@ -19,7 +30,7 @@ export class AuthMiddleware { if (!parsed) { return false; } - return parsed.token === this.authToken; + return safeEqual(parsed.token, this.authToken); } /**