Security: timing attack in auth token comparison (CWE-208)

[spidershield-contrib]

Summary

The authentication token comparison uses === which is vulnerable to timing attacks (CWE-208).

Details

• CWE: CWE-208 (Observable Timing Discrepancy)
• Severity: Medium
• File: config.server.ts
• Impact: An attacker can determine the secret value character-by-character by measuring response time differences.

Suggested Fix

Use constant-time comparison: crypto.timingSafeEqual() (Node.js).

---

Found by SpiderShield security scanner