Sirius/tinyauth
1
0
Fork 0
mirror of https://github.com/tinyauthapp/tinyauth.git synced 2026-09-11 10:13:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: use constant-time secret comparisons

Browse Source 
Co-Authored-By: OpenAI <noreply@openai.com>
This commit is contained in:
Stavros
2026-09-06 19:56:58 +03:00
co-authored by OpenAI
parent b61fc6b54e
commit 0cf64e8598
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/controller/oidc_controller.go
+5 -1
View File
@@ -1,6 +1,8 @@
package controller
import (
"crypto/sha256"
"crypto/subtle"
"encoding/json"
"errors"
"fmt"
@@ -545,7 +547,9 @@ func (controller *OIDCController) Token(c *gin.Context) {
return
}
if client.ClientSecret != creds.ClientSecret {
clientSecretHash := sha256.Sum256([]byte(client.ClientSecret))
providedSecretHash := sha256.Sum256([]byte(creds.ClientSecret))
if subtle.ConstantTimeCompare(clientSecretHash[:], providedSecretHash[:]) != 1 {
controller.log.App.Warn().Str("clientId", creds.ClientID).Msg("Invalid client secret")
c.JSON(400, gin.H{
"error": "invalid_client",