Fix non-constant-time string != comparison

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/securecookie/securecookie.go

@@ -17,6 +17,7 @@ package securecookie
 import (
 	"crypto/hmac"
 	"crypto/sha256"
+	"crypto/subtle"
 	"encoding/base64"
 	"errors"
 	"fmt"
@@ -143,7 +144,7 @@ func Verify(signedValue, secret string) (string, error) {
 		return "", fmt.Errorf("cannot sign value: %w", err)
 	}
 
-	if signedValue != expectedSignedValue {
+	if subtle.ConstantTimeCompare([]byte(signedValue), []byte(expectedSignedValue)) != 1 {
 		return "", ErrInvalidSignature
 	}
 

pkg/securetoken/securetoken.go

@@ -17,6 +17,7 @@ package securetoken
 import (
 	"crypto/hmac"
 	"crypto/sha256"
+	"crypto/subtle"
 	"encoding/base64"
 	"errors"
 	"fmt"
@@ -83,7 +84,7 @@ func Verify(signedValue, secret string) (string, error) {
 		return "", fmt.Errorf("cannot sign value: %w", err)
 	}
 
-	if signedValue != expectedSignedValue {
+	if subtle.ConstantTimeCompare([]byte(signedValue), []byte(expectedSignedValue)) != 1 {
 		return "", ErrInvalidSignature
 	}
 

pkg/statelesstoken/statelesstoken.go

@@ -17,6 +17,7 @@ package statelesstoken
 import (
 	"crypto/hmac"
 	"crypto/sha256"
+	"crypto/subtle"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
@@ -133,7 +134,7 @@ func ValidateToken[T any](secret string, tokenType string, tokenString string) (
 	h.Write([]byte(encodedPayload))
 	expectedSignature := base64.RawURLEncoding.EncodeToString(h.Sum(nil))
 
-	if providedSignature != expectedSignature {
+	if subtle.ConstantTimeCompare([]byte(providedSignature), []byte(expectedSignature)) != 1 {
 		return nil, &ErrInvalidToken{message: "invalid token signature"}
 	}