kalugin66/windmill
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: use constant-time comparison for API key and basic auth validation (#8593)

Browse Source 
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ruben Fiszel
2026-03-29 12:01:52 +00:00
committed by GitHub
parent 8baa7f8a20
commit b4d1f2aac7
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
backend/windmill-trigger-http/src/http_trigger_auth.rs
View File

@@ -621,7 +621,7 @@ impl AuthenticationMethod {
let api_key_to_cmp = headers
.try_get_webhook_header(&api_key_header)
.map_err(|_| AuthenticationError::InvalidApiKey)?;
if api_key_to_cmp != api_key_secret {
if !constant_time_eq(api_key_to_cmp.as_bytes(), api_key_secret.as_bytes()) {
return Err(AuthenticationError::InvalidApiKey);
}
}
@@ -654,8 +654,11 @@ impl AuthenticationMethod {
return Err(AuthenticationError::UnauthorizedBasicHttpAuth);
}
if credentials.get(0).unwrap() != username
|| credentials.get(1).unwrap() != password
if !constant_time_eq(credentials.get(0).unwrap().as_bytes(), username.as_bytes())
|| !constant_time_eq(
credentials.get(1).unwrap().as_bytes(),
password.as_bytes(),
)
{
return Err(AuthenticationError::UnauthorizedBasicHttpAuth);
}