CVE-2015-10004: Merge pull request #13 from polezaivsani/fix_timming_sidechannel · robbert229/jwt@ca1404e

Skip to content

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

*   Explore
*   All features
*   Documentation
*   GitHub Skills
*   Blog

• • For

  • Enterprise

  • Teams

  • Startups

  • Education

  • By Solution

  • CI/CD & Automation

  • DevOps

  • DevSecOps

  • Case Studies

  • Customer Stories

  • Resources

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles
    

*   Repositories
*   Topics
*   Trending
*   Collections

• Pricing

• Notifications

• Fork 28

• Code

• Issues 7

• Pull requests 1

• Actions

• Projects

• Security

• Insights

Permalink

Browse files

Merge pull request #13 from polezaivsani/fix_timming_sidechannel

Spoil timming side-channel attack when comparing macs

• Loading branch information

2 parents 2eb16e9 + eddce24 commit ca1404ee6e83fcbafb66b09ed0d543850a15b654

Showing 1 changed file with 1 addition and 1 deletion.

@@ -142,7 +142,7 @@ func (a *Algorithm) validateSignature(encoded string) error {

b64SignedAttempt := base64.RawURLEncoding.EncodeToString([]byte(signedAttempt))

if strings.Compare(b64Signature, b64SignedAttempt) != 0 {

if !hmac.Equal([]byte(b64Signature), []byte(b64SignedAttempt)) {

return errors.New(“invalid signature”)

}

0 comments on commit ca1404e

Please sign in to comment.