module JWT::JWA::Hmac::SecurityUtils
Copy of github.com/rails/rails/blob/v7.0.3.1/activesupport/lib/active_support/security_utils.rb rubocop:disable Naming/MethodParameterName, Style/StringLiterals, Style/NumericPredicate
Public Class Methods
# File lib/jwt/jwa/hmac.rb, line 51 def fixed_length_secure_compare(a, b) OpenSSL.fixed_length_secure_compare(a, b) end
Secure string comparison for strings of variable length.
While a timing attack would not be able to discern the content of a secret compared via secure_compare
, it is possible to determine the secret length. This should be considered when using secure_compare
to compare weak, short secrets to user input.
# File lib/jwt/jwa/hmac.rb, line 75 def secure_compare(a, b) a.bytesize == b.bytesize && fixed_length_secure_compare(a, b) end
Private Instance Methods
# File lib/jwt/jwa/hmac.rb, line 51 def fixed_length_secure_compare(a, b) OpenSSL.fixed_length_secure_compare(a, b) end
Secure string comparison for strings of variable length.
While a timing attack would not be able to discern the content of a secret compared via secure_compare
, it is possible to determine the secret length. This should be considered when using secure_compare
to compare weak, short secrets to user input.
# File lib/jwt/jwa/hmac.rb, line 75 def secure_compare(a, b) a.bytesize == b.bytesize && fixed_length_secure_compare(a, b) end