fix(server-legacy): use constant-time compare for OAuth client_secret

[Rahul-s-007]

Closes #2780

What

authenticateClient compared the client-supplied client_secret against the stored one with plain !==. Swapped to crypto.timingSafeEqual (with an explicit length check up front, since timingSafeEqual throws on unequal-length buffers rather than returning false).

Why

Plain string comparison short-circuits at the first mismatching character — a timing side channel (CWE-208) on a value meant to be secret. This repo already treats this class of bug as worth avoiding: requestStateCodec.ts explicitly uses SubtleCrypto.verify for its own HMAC check specifically because it's constant-time by spec. This brings clientAuth.ts in line with that same standard.

Testing

• Added a test covering the timingSafeEqual length-mismatch path specifically (a different-length wrong secret), since that's the one edge case the naive !== version didn't need to handle.
• All existing clientAuth tests continue to pass unchanged.
• pnpm --filter @modelcontextprotocol/server-legacy test — 169/169 passed.
• pnpm --filter @modelcontextprotocol/server-legacy lint / typecheck — clean.
• Pre-push hook (build + typecheck + lint across the monorepo) passed.

Small, focused, single-file change plus its test — should be a quick review.

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 962ef38

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2781

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2781

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2781

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2781

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2781

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2781

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2781

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2781

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2781

commit: 962ef38