Sirius/tinyauth
1
0
Fork 0
mirror of https://github.com/tinyauthapp/tinyauth.git synced 2026-09-10 17:42:23 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: use constant-time secret comparisons

Browse Source 
Co-Authored-By: OpenAI <noreply@openai.com>
This commit is contained in:
Stavros
2026-09-06 19:56:58 +03:00
co-authored by OpenAI
parent b61fc6b54e
commit 0cf64e8598
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/service/oidc_service.go
+2 -1
View File
@@ -6,6 +6,7 @@ import (
"crypto/rand"
"crypto/rsa"
"crypto/sha256"
"crypto/subtle"
"crypto/x509"
"encoding/base64"
"encoding/json"
@@ -882,7 +883,7 @@ func (service *OIDCService) ValidatePKCE(codeChallenge string, codeVerifier stri
if codeChallenge == "" {
return true
}
return codeChallenge == service.hashAndEncodePKCE(codeVerifier)
return subtle.ConstantTimeCompare([]byte(codeChallenge), []byte(service.hashAndEncodePKCE(codeVerifier))) == 1
}
func (service *OIDCService) hashAndEncodePKCE(codeVerifier string) string {