Use constant-time string comparison for sigs

Fixed jasongoodwin#12
merit · Nov 5, 2017 · 2d2fa0d · 2d2fa0d
1 parent 69b631f
commit 2d2fa0d
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/main/scala/authentikat/jwt/JsonWebToken.scala b/src/main/scala/authentikat/jwt/JsonWebToken.scala
@@ -84,7 +84,7 @@ object JsonWebToken extends JsonMethods {
         val signature = encodeBase64URLSafeString(
           JsonWebSignature(header.algorithm.getOrElse("none"), providedHeader + "." + providedClaims, key))
 
-        providedSignature.contentEquals(signature)
+        java.security.MessageDigest.isEqual(providedSignature.getBytes(), signature.getBytes())
       case _ ⇒
         false
     }