Rules Hub
Code Ruleset
Rule priority, scope & exceptions
Use this to align rules with the senior-level structure (P0/P1/P2, scope, exceptions/tradeoffs).
Compare secrets in constant time
Use timing-safe comparison for secrets and tokens, not === / !==.
Bad example
| 1 | if (providedToken !== expectedToken) { |
| 2 | throw new UnauthorizedException(); |
| 3 | } |
Explanation (EN)
Ordinary equality can reveal matching-prefix timing when secret comparison is exposed to an attacker.
Objašnjenje (HR)
Obična usporedba može odati podudaranje prefiksa kroz vrijeme izvođenja kada je napadaču dostupna provjera tajne.
Good example
| 1 | import { timingSafeEqual } from 'node:crypto'; |
| 2 |
|
| 3 | const a = Buffer.from(providedToken); |
| 4 | const b = Buffer.from(expectedToken); |
| 5 | if (a.length !== b.length || !timingSafeEqual(a, b)) { |
| 6 | throw new UnauthorizedException(); |
| 7 | } |
Explanation (EN)
Equal-length byte comparison avoids prefix-dependent comparison work; the surrounding protocol still needs its own timing and validation review.
Objašnjenje (HR)
Usporedba bajtova jednake duljine izbjegava posao ovisan o podudarnom prefiksu. Okolni protokol i dalje zahtijeva vlastitu provjeru vremena izvođenja i validacije.
Notes (EN)
Use the platform timing-safe primitive on validated byte representations of secrets/MACs, with the required equal-length check. Review the surrounding verification path too.
Bilješke (HR)
Za validirane nizove bajtova tajni ili MAC vrijednosti koristi platformski timing-safe primitiv uz potrebnu provjeru jednake duljine. Pregledaj i cijeli okolni postupak provjere.
Exceptions / Tradeoffs (EN)
Non-secret value comparisons (regular business logic) do not need constant-time comparison. The primitive does not make parsing, length checks, lookup or error paths timing-safe. Prefer fixed-size authenticated digests where the protocol requires a fixed comparison domain.
Iznimke / Tradeoffi (HR)
Obične poslovne usporedbe ne zahtijevaju konstantno vrijeme. Primitiv ne štiti automatski parsiranje, provjere duljine, dohvat ni putove pogrešaka. Kada protokol to zahtijeva, uspoređuj autentificirane sažetke fiksne veličine.