You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Sep 17, 2021. It is now read-only.
I came across your simple-passport package in the laravel-news community links. I came across a small security issue while reviewing the code. In the following two places it’s possible for an attacker to use a timing attack because the token comparison is not done in constant time. This article has some great background info on how timing attacks work. To mitigate this risk you can use the hash_equals function instead.
Hello,
I came across your simple-passport package in the laravel-news community links. I came across a small security issue while reviewing the code. In the following two places it’s possible for an attacker to use a timing attack because the token comparison is not done in constant time. This article has some great background info on how timing attacks work. To mitigate this risk you can use the hash_equals function instead.
simple-passport/src/Http/Controllers/PasswordController.php
Line 42 in 351a363
https://github.com/heloufir/simple-passport/blob/1.5.2/src/Helpers/TokenHandler.php#L29
Big thanks to Matthew Allan ([email protected])
The text was updated successfully, but these errors were encountered: