Skip to content
Sarj Sarj Sarj Standards

prefer-constant-time-secret-compare

Prefer a supported constant-time comparison primitive for secret-like values.

preferConstantTimeSecretCompare Rule source Tests Catalog JSON

Why

Ordinary equality offers no constant-time guarantee for comparing secrets.

Fix

Compare equal-length cryptographic digests with a constant-time comparison primitive.

Examples

Before — flagged Do not compare authentication tokens with equality
src/auth.ts
if (presentedAccessToken === expectedAccessToken) {
  allow();
}
After — preferred Use a constant-time comparison
src/auth.ts
if (await constantTimeEqual(presentedAccessToken, expectedAccessToken)) {
  allow();
}