# HG changeset patch
# User Matthew Wild <mwild1@gmail.com>
# Date 1620911587 -3600
# Node ID d2f33b8fdc968b594e596d73d200dbfb6679dd02
# Parent  3bbb1af92514131df4a83befc810d97457686479
util.jwt: Use constant-time comparison with expected signature

diff -r 3bbb1af92514 -r d2f33b8fdc96 util/jwt.lua
--- a/util/jwt.lua	Thu May 13 11:17:13 2021 +0100
+++ b/util/jwt.lua	Thu May 13 14:13:07 2021 +0100
@@ -3,6 +3,7 @@
 local hashes = require "util.hashes";
 local base64_encode = require "util.encodings".base64.encode;
 local base64_decode = require "util.encodings".base64.decode;
+local secure_equals = require "util.hashes".equals;
 
 local b64url_rep = { ["+"] = "-", ["/"] = "_", ["="] = "", ["-"] = "+", ["_"] = "/" };
 local function b64url(data)
@@ -33,7 +34,7 @@
 	elseif header.alg ~= "HS256" then
 		return nil, "unsupported-algorithm";
 	end
-	if b64url(hashes.hmac_sha256(key, signed)) ~= signature then
+	if not secure_equals(b64url(hashes.hmac_sha256(key, signed)), signature) then
 		return false, "signature-mismatch";
 	end
 	local payload, err = json.decode(unb64url(bpayload));