From b4d1f2aac789306c2e35e123ac93e12c47c26f99 Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Sun, 29 Mar 2026 12:01:52 +0000 Subject: [PATCH] fix: use constant-time comparison for API key and basic auth validation (#8593) Co-authored-by: Claude Opus 4.6 (1M context) --- backend/windmill-trigger-http/src/http_trigger_auth.rs | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/backend/windmill-trigger-http/src/http_trigger_auth.rs b/backend/windmill-trigger-http/src/http_trigger_auth.rs index 987d0ac811..07b7a5f0a4 100644 --- a/backend/windmill-trigger-http/src/http_trigger_auth.rs +++ b/backend/windmill-trigger-http/src/http_trigger_auth.rs @@ -621,7 +621,7 @@ impl AuthenticationMethod { let api_key_to_cmp = headers .try_get_webhook_header(&api_key_header) .map_err(|_| AuthenticationError::InvalidApiKey)?; - if api_key_to_cmp != api_key_secret { + if !constant_time_eq(api_key_to_cmp.as_bytes(), api_key_secret.as_bytes()) { return Err(AuthenticationError::InvalidApiKey); } } @@ -654,8 +654,11 @@ impl AuthenticationMethod { return Err(AuthenticationError::UnauthorizedBasicHttpAuth); } - if credentials.get(0).unwrap() != username - || credentials.get(1).unwrap() != password + if !constant_time_eq(credentials.get(0).unwrap().as_bytes(), username.as_bytes()) + || !constant_time_eq( + credentials.get(1).unwrap().as_bytes(), + password.as_bytes(), + ) { return Err(AuthenticationError::UnauthorizedBasicHttpAuth); }