Skip to content
Sarj Standards

TypeScript · security

prefer-constant-time-secret-compare

eslint:prefer-constant-time-secret-compare

Disallow `===`/`!==` on a secret-like value; short-circuiting comparison leaks the secret through timing. Use a constant-time compare.

Default
error
Fix
none
Languages
typescript

Why

Ordinary equality stops at the first differing byte, allowing repeated measurements to reveal secret material.

Fix

Compare equal-length cryptographic digests with a constant-time comparison primitive.

Before / after

Executed by this rule’s unit tests.

Before

Do not compare secrets with equality

src/auth.ts · focus
if (presentedToken === expectedToken) { allow(); }

After

Use a constant-time comparison

src/auth.ts · focus
if (await constantTimeEqual(presentedToken, expectedToken)) { allow(); }

Limits

  • Secret-like values are identified conservatively from their names; test files and public sentinel comparisons are excluded.

Message IDs

preferConstantTimeSecretCompare