Remove unnecessary secure compare
Closed this issue ยท 0 comments
adamniedzielski commented
Thanks @DamirSvrtan for explaining this to me! ๐
Here we load all the tokens for the given user into the memory and perform secure compare on them.
Secure compare was necessary to prevent timing attacks when we were storing tokens in the database. However, since version 0.5.0 we are storing only token digests which has a side effect of preventing timing attacks.
We can:
- replace the code with a single SQL query
- suggest adding an index on
body
column in the README