From 8d1357cf09a89f2f462eee5ab1706a2a8cc7a323 Mon Sep 17 00:00:00 2001
From: Stefan Stammberger <some.fusion@gmail.com>
Date: Sun, 3 Oct 2021 10:58:46 +0200
Subject: [PATCH] feat: use secrets.compare_digest in login

More info:
https://fastapi.tiangolo.com/advanced/security/http-basic-auth/#timing-attacks
---
 app/routers/system.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/app/routers/system.py b/app/routers/system.py
index 9804c6a..ac74226 100644
--- a/app/routers/system.py
+++ b/app/routers/system.py
@@ -1,3 +1,5 @@
+import secrets
+
 from app.auth.auth_bearer import JWTBearer
 from app.auth.auth_handler import signJWT
 from app.models.system import LoginInput, RawDebugLogData, SystemInfo
@@ -32,7 +34,8 @@ router = APIRouter(prefix=f"/{_PREFIX}", tags=["System"])
     status_code=status.HTTP_200_OK,
 )
 def login(i: LoginInput):
-    if i.password == config("login_password", cast=str):
+    match = secrets.compare_digest(i.password, config("login_password", cast=str))
+    if match:
         return signJWT()
 
     raise HTTPException(status.HTTP_401_UNAUTHORIZED, detail="Password is wrong")