Security: constant-time comparison for REST API credentials#1376
Conversation
validate_credentials() compared the stored API key and secret with === , which short-circuits on the first differing byte and can leak the values through response timing. Compare with hash_equals() instead, and reject the 'prevent' sentinel (used before credentials are generated) and empty credentials explicitly so they can never authenticate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 28 minutes and 51 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Summary
API::validate_credentials()compared the stored API key and secret with===,which short-circuits on the first differing byte and can leak the values through
response timing.
Changes
hash_equals()(constant time).preventsentinel (stored before credentials are generated) andempty credentials explicitly, so an unconfigured key/secret can never
authenticate.
Compatibility
Pure hardening; valid credentials authenticate exactly as before.
Part of a small series of focused security hardening PRs. Full technical detail
is available privately to the maintainers on request (coordinated disclosure).