Operators like ==
and ===
are not time-safe and can make your application vulnerable to a timing attack, which might enable attackers to infer security-sensitive information.
1var express = require('express')
2var app = express()
3
4function timingAttackNoncompliant() {
5 app.get('/user/login', function (req, res) {
6 // Noncompliant: '===' operator is used with sensitive data field.
7 if(password === "myPass") {
8 logIn()
9 }
10 })
11}
1var express = require('express')
2var app = express()
3var compare = require('secure-compare')
4
5function timingAttackCompliant() {
6 app.get('/user/login', function (req, res) {
7 // Compliant: sensitive data field is compared using 'secure-compare'.
8 if(compare(password, "myPass")) {
9 logIn()
10 }
11 })
12}