From e59cc1af2ed556cfd34b39bd93baa8f27b4bba67 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Mon, 16 Feb 2026 17:44:02 +0000
Subject: [PATCH] Fix timing attack vulnerability in token verification

Replaced insecure string comparison with `secrets.compare_digest` in `_check_token` to prevent timing attacks.
Added a test case for missing token to ensure robust error handling.

Co-authored-by: PR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
---
 src/seedpass/api.py   |  3 ++-
 src/tests/test_api.py | 10 ++++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/seedpass/api.py b/src/seedpass/api.py
index 110a7d12..a22ff7bd 100644
--- a/src/seedpass/api.py
+++ b/src/seedpass/api.py
@@ -25,7 +25,8 @@ _token: str = ""
 
 
 def _check_token(auth: str | None) -> None:
-    if auth != f"Bearer {_token}":
+    expected = f"Bearer {_token}"
+    if auth is None or not secrets.compare_digest(auth, expected):
         raise HTTPException(status_code=401, detail="Unauthorized")
 
 
diff --git a/src/tests/test_api.py b/src/tests/test_api.py
index 6d0db7fc..d1470415 100644
--- a/src/tests/test_api.py
+++ b/src/tests/test_api.py
@@ -65,6 +65,16 @@ def test_invalid_token(client):
     assert res.status_code == 401
 
 
+def test_missing_token(client):
+    cl, _token = client
+    # No Authorization header
+    res = cl.get(
+        "/api/v1/entry",
+        params={"query": "s"},
+    )
+    assert res.status_code == 401
+
+
 def test_get_entry_by_id(client):
     cl, token = client
     headers = {