Skip to content

fix(graphql): constant-time admin secret comparison [H7]#555

Merged
lakhansamani merged 1 commit into
mainfrom
fix/h7-admin-secret-timing
Apr 4, 2026
Merged

fix(graphql): constant-time admin secret comparison [H7]#555
lakhansamani merged 1 commit into
mainfrom
fix/h7-admin-secret-timing

Conversation

@lakhansamani
Copy link
Copy Markdown
Contributor

@lakhansamani lakhansamani commented Apr 3, 2026

Summary

  • H7 (High): Admin secret compared with != (timing attack vulnerable)
  • Now uses crypto/subtle.ConstantTimeCompare
  • Consistent with IsSuperAdmin which already uses constant-time comparison

Test plan

  • Package compiles
  • Verify admin login still works
@lakhansamani
fix(graphql): use constant-time comparison for admin secret
2a3a0c3 
Admin secret was compared with != which is vulnerable to timing
attacks. Now uses crypto/subtle.ConstantTimeCompare, consistent
with the IsSuperAdmin function elsewhere in the codebase.

Fixes: H7 (High)
@lakhansamani lakhansamani merged commit d7a1c8f into main Apr 4, 2026
@lakhansamani lakhansamani deleted the fix/h7-admin-secret-timing branch April 4, 2026 05:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant

@lakhansamani