Add constant time compare to basic auth password (fixes #194)

motiv-labs · Oct 8, 2017 · d1fe91b · d1fe91b
1 parent 9329ba1
commit d1fe91b
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/pkg/plugin/basic/middleware.go b/pkg/plugin/basic/middleware.go
@@ -1,6 +1,7 @@
 package basic
 
 import (
+	"crypto/subtle"
 	"net/http"
 
 	"github.com/hellofresh/janus/pkg/errors"
@@ -32,7 +33,7 @@ func NewBasicAuth(repo Repository) func(http.Handler) http.Handler {
 			}
 
 			for _, u := range users {
-				if username == u.Username && password == u.Password {
+				if username == u.Username && (subtle.ConstantTimeCompare([]byte(password), []byte(u.Password)) == 1) {
 					found = true
 					break
 				}