medlogic
/
olivetin
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: Constant time comparison for webhook authentication

This commit is contained in:
jamesread 2026-01-06 22:11:41 +00:00
parent f22b3953b1
commit 0b072db36d
2 changed files with 11 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
service/internal/webhooks/auth.go
View File

@ -2,6 +2,7 @@ package webhooks
import ( import (
"crypto/hmac" "crypto/hmac"
"crypto/subtle"
"crypto/sha1" "crypto/sha1"
"crypto/sha256" "crypto/sha256"
"encoding/hex" "encoding/hex"
@ -105,7 +106,9 @@ func (v *AuthVerifier) verifyBearer(r *http.Request) bool {
} }
token := strings.TrimPrefix(authHeader, "Bearer ") token := strings.TrimPrefix(authHeader, "Bearer ")
return token == v.config.Secret tokenBytes := []byte(token)
secretBytes := []byte(v.config.Secret)
return len(tokenBytes) == len(secretBytes) && subtle.ConstantTimeCompare(tokenBytes, secretBytes) == 1
} }
func (v *AuthVerifier) verifyBasic(r *http.Request) bool { func (v *AuthVerifier) verifyBasic(r *http.Request) bool {

1
service/internal/webhooks/matcher.go
View File

@ -12,7 +12,6 @@ import (
type WebhookMatcher struct { type WebhookMatcher struct {
config config.WebhookConfig config config.WebhookConfig
req *http.Request req *http.Request
body interface{}
bodyBytes []byte bodyBytes []byte
} }