From 0cf64e8598c1314ca54f196bd588d2c69c8f7740 Mon Sep 17 00:00:00 2001
From: Stavros <steveiliop56@gmail.com>
Date: Sun, 6 Sep 2026 19:55:00 +0300
Subject: [PATCH] fix: use constant-time secret comparisons

Co-Authored-By: OpenAI <noreply@openai.com>
---
 internal/controller/oidc_controller.go | 6 +++++-
 internal/service/oidc_service.go       | 3 ++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/internal/controller/oidc_controller.go b/internal/controller/oidc_controller.go
index 99fd78f2..a4b2d76d 100644
--- a/internal/controller/oidc_controller.go
+++ b/internal/controller/oidc_controller.go
@@ -1,6 +1,8 @@
 package controller
 
 import (
+	"crypto/sha256"
+	"crypto/subtle"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -545,7 +547,9 @@ func (controller *OIDCController) Token(c *gin.Context) {
 		return
 	}
 
-	if client.ClientSecret != creds.ClientSecret {
+	clientSecretHash := sha256.Sum256([]byte(client.ClientSecret))
+	providedSecretHash := sha256.Sum256([]byte(creds.ClientSecret))
+	if subtle.ConstantTimeCompare(clientSecretHash[:], providedSecretHash[:]) != 1 {
 		controller.log.App.Warn().Str("clientId", creds.ClientID).Msg("Invalid client secret")
 		c.JSON(400, gin.H{
 			"error": "invalid_client",
diff --git a/internal/service/oidc_service.go b/internal/service/oidc_service.go
index 62f60cbc..c5f8ecd3 100644
--- a/internal/service/oidc_service.go
+++ b/internal/service/oidc_service.go
@@ -6,6 +6,7 @@ import (
 	"crypto/rand"
 	"crypto/rsa"
 	"crypto/sha256"
+	"crypto/subtle"
 	"crypto/x509"
 	"encoding/base64"
 	"encoding/json"
@@ -882,7 +883,7 @@ func (service *OIDCService) ValidatePKCE(codeChallenge string, codeVerifier stri
 	if codeChallenge == "" {
 		return true
 	}
-	return codeChallenge == service.hashAndEncodePKCE(codeVerifier)
+	return subtle.ConstantTimeCompare([]byte(codeChallenge), []byte(service.hashAndEncodePKCE(codeVerifier))) == 1
 }
 
 func (service *OIDCService) hashAndEncodePKCE(codeVerifier string) string {