Merge pull request #877 from PR0M3TH3AN/security-fix-token-timing-attack-14331876507002006471

🔒 Fix timing attack vulnerability in API token verification

src/seedpass/api.py

@@ -25,7 +25,8 @@ _token: str = ""
 
 
 def _check_token(auth: str | None) -> None:
-    if auth != f"Bearer {_token}":
+    expected = f"Bearer {_token}"
+    if auth is None or not secrets.compare_digest(auth, expected):
         raise HTTPException(status_code=401, detail="Unauthorized")
 
 

src/tests/test_api.py

@@ -65,6 +65,16 @@ def test_invalid_token(client):
     assert res.status_code == 401
 
 
+def test_missing_token(client):
+    cl, _token = client
+    # No Authorization header
+    res = cl.get(
+        "/api/v1/entry",
+        params={"query": "s"},
+    )
+    assert res.status_code == 401
+
+
 def test_get_entry_by_id(client):
     cl, token = client
     headers = {