@juspay/neurolink
Version:
The pipe layer of an AI nervous system: one interface connecting provider neurons to your application, across three inference types — generate, stream and decide. `decide` returns typed, calibrated judgements from a non-generative model (~400ms, ~$0.00002
23 lines (22 loc) • 941 B
JavaScript
import crypto from "crypto";
/**
* Constant-time bearer-token comparison.
*
* Bug 2 mitigation: a normal `===` compare on bearer tokens leaks the token
* length and the position of the first mismatching byte through timing
* differences, which is reachable when the voice server is bound publicly
* (`VOICE_SERVER_ALLOW_PUBLIC=1`).
*
* Returns `false` for any comparison whose lengths differ — this avoids the
* `RangeError` that `crypto.timingSafeEqual` throws on mismatched buffers
* while still preserving the constant-time property for equal-length inputs
* (which is the only case an attacker can probe).
*/
export function timingSafeEqualString(provided, expected) {
const providedBuf = Buffer.from(provided, "utf8");
const expectedBuf = Buffer.from(expected, "utf8");
if (providedBuf.length !== expectedBuf.length) {
return false;
}
return crypto.timingSafeEqual(providedBuf, expectedBuf);
}