Skip to content

K
k3s
Unverified Commit c46d6bb8 authored by Joe Beda's avatar Joe Beda
Browse files
Options

Use constant time compare for bootstrap tokens

Signed-off-by: 's avatarJoe Beda <joe.github@bedafamily.com>
parent 5e29e1ee
Hide whitespace changes
Inline Side-by-side
Showing with 2 additions and 1 deletion
plugin/pkg/auth/authenticator/token/bootstrap/bootstrap.go
View file @ c46d6bb8
...@@ -20,6 +20,7 @@ Package bootstrap provides a token authenticator for TLS bootstrap secrets. ...@@ -20,6 +20,7 @@ Package bootstrap provides a token authenticator for TLS bootstrap secrets.
package bootstrap package bootstrap
import ( import (
"crypto/subtle"
"fmt" "fmt"
"regexp" "regexp"
"time" "time"
...@@ -95,7 +96,7 @@ func (t *TokenAuthenticator) AuthenticateToken(token string) (user.Info, bool, e ...@@ -95,7 +96,7 @@ func (t *TokenAuthenticator) AuthenticateToken(token string) (user.Info, bool, e
} }
ts := getSecretString(secret, bootstrapapi.BootstrapTokenSecretKey) ts := getSecretString(secret, bootstrapapi.BootstrapTokenSecretKey)
if ts != tokenSecret { if subtle.ConstantTimeCompare([]byte(ts), []byte(tokenSecret)) != 1 {
return nil, false, nil return nil, false, nil
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment