Use constant time comparison for WHIP tokens.

Thanks to Vinayak Mishra.
2026-04-30 00:18:29 +02:00
parent ab44a661cb
commit e3f098e189
1 changed files with 1 additions and 1 deletions
@@ -295,7 +295,7 @@ func whipResourceHandler(w http.ResponseWriter, r *http.Request) {

 	if t := c.Token(); t != "" {
 		token := parseBearerToken(r.Header.Get("Authorization"))
-		if token != t {
+		if !group.ConstantTimeCompare(t, token) {
 			http.Error(w, "Forbidden", http.StatusForbidden)
 			return
 		}