From e3f098e1894cddaf2114c9019235c19d2dfb89f6 Mon Sep 17 00:00:00 2001
From: Juliusz Chroboczek <jch@irif.fr>
Date: Thu, 30 Apr 2026 00:18:29 +0200
Subject: [PATCH] Use constant time comparison for WHIP tokens.

Thanks to Vinayak Mishra.
---
 webserver/whip.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/webserver/whip.go b/webserver/whip.go
index 04b44b5..b5b2a70 100644
--- a/webserver/whip.go
+++ b/webserver/whip.go
@@ -295,7 +295,7 @@ func whipResourceHandler(w http.ResponseWriter, r *http.Request) {
 
 	if t := c.Token(); t != "" {
 		token := parseBearerToken(r.Header.Get("Authorization"))
-		if token != t {
+		if !group.ConstantTimeCompare(t, token) {
 			http.Error(w, "Forbidden", http.StatusForbidden)
 			return
 		}