Fix non-constant-time string != comparison

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/securetoken/securetoken.go

@@ -17,6 +17,7 @@ package securetoken
 import (
 	"crypto/hmac"
 	"crypto/sha256"
+	"crypto/subtle"
 	"encoding/base64"
 	"errors"
 	"fmt"
@@ -83,7 +84,7 @@ func Verify(signedValue, secret string) (string, error) {
 		return "", fmt.Errorf("cannot sign value: %w", err)
 	}
 
-	if signedValue != expectedSignedValue {
+	if subtle.ConstantTimeCompare([]byte(signedValue), []byte(expectedSignedValue)) != 1 {
 		return "", ErrInvalidSignature
 	}