Snippet

Constant-Time HMAC Token Verification in Custom Auth Backends

Custom Django authentication backends should utilize hmac.compare_digest to mitigate side-channel timing attacks during cryptographic token signature validation.

snippet.py

python

import hmac
import hashlib
from django.contrib.auth.backends import BaseBackend
from django.contrib.auth.models import User
 
class ConstantTimeHMACBackend(BaseBackend):
    def authenticate(self, request, token=None, signature=None, secret_key=None):
        if not (token and signature and secret_key):
            return None
        expected_sig = hmac.new(
            secret_key.encode(), token.encode(), hashlib.sha256
        ).hexdigest()
        if hmac.compare_digest(expected_sig, signature):
            return User.objects.filter(username=token).first()
        return None

django

Breakdown

class ConstantTimeHMACBackend(BaseBackend):

Subclasses Django BaseBackend to construct custom authentication pipelines.

expected_sig = hmac.new(secret_key.encode(), token.encode(), hashlib.sha256).hexdigest()

Computes SHA-256 HMAC signature using secret key and request token payload.

if hmac.compare_digest(expected_sig, signature):

Performs constant-time string comparison to neutralize timing side-channel exploits.

Previous snippet Next snippet

More Expert Python exercises →

Constant-Time HMAC Token Verification in Custom Auth Backends

Related