Skip to content
Sarj Sarj Sarj Standards

prefer-constant-time-secret-compare

Externally supplied authenticators are compared with timing-sensitive equality.

SARJ011 Rule source Tests Catalog JSON

Why

Ordinary equality may short-circuit based on matching content when attacker-controlled credentials are checked against configured secret state.

Fix

For opaque tokens and MACs, normalize both operands to the same supported type and use hmac.compare_digest; for passwords, use the password-hashing library's verification API.

Examples

Before — flagged Request API key uses ordinary equality
auth.py
def authenticated(request, settings):
    return request.headers["X-API-Key"] == settings.api_key
After — preferred Request API key uses constant-time comparison
auth.py
import hmac




def authenticated(request, settings):
    provided = request.headers["X-API-Key"]
    return hmac.compare_digest(
        provided.encode("ascii"), settings.api_key.encode("ascii")
    )