Security: timing attack in auth comparison (CWE-208)

[spidershield-contrib]

Summary

Authentication credentials are compared using ===/== which is vulnerable to timing side-channel attacks (CWE-208).

Details

• CWE: CWE-208 (Observable Timing Discrepancy)
• Severity: Medium
• Files: apps/nestjs-backend/src/features/auth/local-auth/local-auth.service.ts, apps/nestjs-backend/src/features/auth/permission.service.ts
• Impact: An attacker can determine the secret value by measuring response time differences.

Suggested Fix

Use constant-time comparison: crypto.timingSafeEqual() (Node.js).

---

Found by SpiderShield security scanner