Skip to content

Commit

Permalink
emerose.com offline
Browse files Browse the repository at this point in the history
  • Loading branch information
pjfanning committed Sep 15, 2024
1 parent 03f9e0b commit f9bead6
Showing 1 changed file with 1 addition and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ as defined in [RFC 6750](https://tools.ietf.org/html/rfc6750), and allow users t

When transforming request `Credentials` into an application specific user identifier the naive solution for
checking the secret (password) would be a regular string comparison, but doing this would open up the application to
timing attacks. See for example [Timing Attacks Explained](https://emerose.com/timing-attacks-explained) for an explanation of the problem.
timing attacks. See for example [Timing Attacks Explained](https://web.archive.org/web/20230902003704/https://emerose.com/timing-attacks-explained) for an explanation of the problem.

To protect users of the library from that mistake the secret is not available through the API, instead the method
`Credentials.Provided.verify(String)` should be used. It does a constant time comparison rather than returning early
Expand Down

0 comments on commit f9bead6

Please sign in to comment.