Use constant time compare for bootstrap tokens

Signed-off-by: Joe Beda <joe.github@bedafamily.com>

Use constant time compare for bootstrap tokens
c46d6bb8 · Joe Beda · 5e29e1ee · c46d6bb8
Unverified Commit c46d6bb8 authored Mar 14, 2017 by Joe Beda
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 1 deletion

bootstrap.go plugin/pkg/auth/authenticator/token/bootstrap/bootstrap.go +2 -1

No files found.
--- a/plugin/pkg/auth/authenticator/token/bootstrap/bootstrap.go
+++ b/plugin/pkg/auth/authenticator/token/bootstrap/bootstrap.go
@@ -20,6 +20,7 @@ Package bootstrap provides a token authenticator for TLS bootstrap secrets.
 package bootstrap

 import (
+	"crypto/subtle"
 	"fmt"
 	"regexp"
 	"time"
@@ -95,7 +96,7 @@ func (t *TokenAuthenticator) AuthenticateToken(token string) (user.Info, bool, e
 	}

 	ts := getSecretString(secret, bootstrapapi.BootstrapTokenSecretKey)
-	if ts != tokenSecret {
+	if subtle.ConstantTimeCompare([]byte(ts), []byte(tokenSecret)) != 1 {
 		return nil, false, nil
 	}