javascript / intermediate
Snippet
Preventing Timing Attacks with crypto
When comparing secrets like API keys, standard equality operators (===) return early as soon as a mismatch is found. This allows attackers to measure the time taken to guess the key. timingSafeEqual ensures the comparison always takes the same amount of time.
snippet.js
1
2
3
4
5
6
7
8
9
10
11
const crypto = require('crypto');function verifySecret(input, actual) {const inputBuffer = Buffer.from(input);const actualBuffer = Buffer.from(actual);if (inputBuffer.length !== actualBuffer.length) {return false;}return crypto.timingSafeEqual(inputBuffer, actualBuffer);}
nodejs
Breakdown
1
crypto.timingSafeEqual(inputBuffer, actualBuffer);
Performs a constant-time comparison of two buffers to prevent side-channel timing analysis.