@gotcos/glasses-server 6.12.3 → 6.12.4

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 6.12.4
+
+Completes the public launch security review with a constant-time token check.
+
+- **API tokens compare in constant time.** The `/api` middleware and the
+  OpenAI-compatible `/v1/chat/completions` Bearer check no longer use a plain
+  `!==` string compare, which short-circuits on the first differing byte and
+  leaks token bytes through response timing. Both now hash each side to a fixed
+  SHA-256 digest and compare with `crypto.timingSafeEqual`. Missing headers,
+  duplicated headers, and length-mismatched tokens fail closed without throwing.
+  A new `token-auth` test pins the behavior. 401 responses are otherwise
+  unchanged.
+
 ## 6.12.3
 
 Security hardening from the public launch review, without changing app/server

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.12.3",
+  "version": "6.12.4",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by your local Claude Code or Codex CLI",
   "type": "module",
   "bin": {

package/server/index.ts

@@ -57,6 +57,7 @@ import {
   isAllowedNetworkOrigin,
   isTailscaleIpv4,
 } from './lib/network-policy.js'
+import { timingSafeTokenEqual } from './lib/token-auth.js'
 
 const app = express()
 const PORT = parseInt(process.env.PORT ?? '3141', 10)
@@ -128,7 +129,7 @@ app.use('/api', (req, res, next) => {
     req.path === '/diag/client' ||
     req.path === '/diag/health'
   ) return next()
-  if (req.headers['x-cos-token'] !== API_TOKEN) {
+  if (!timingSafeTokenEqual(req.headers['x-cos-token'], API_TOKEN)) {
     return res.status(401).json({ error: 'unauthorized' })
   }
   next()

package/server/lib/token-auth.ts

@@ -0,0 +1,26 @@
+// Constant-time API-token comparison for the public server.
+
+import { createHash, timingSafeEqual } from 'node:crypto'
+
+/**
+ * Compare a client-supplied API token against the expected token without
+ * leaking token bytes through response timing.
+ *
+ * A plain `provided !== expected` string compare short-circuits at the first
+ * differing byte, so an attacker measuring response latency can recover the
+ * token one byte at a time. Hashing both sides to a fixed 32-byte SHA-256
+ * digest before `timingSafeEqual` keeps the comparison constant time
+ * regardless of input length, and avoids `timingSafeEqual` throwing on
+ * length-mismatched buffers.
+ *
+ * Non-string input (missing header, duplicated header parsed as an array) and
+ * an empty expected token never match.
+ */
+export function timingSafeTokenEqual(provided: unknown, expected: string): boolean {
+  if (typeof provided !== 'string' || typeof expected !== 'string' || expected.length === 0) {
+    return false
+  }
+  const a = createHash('sha256').update(provided).digest()
+  const b = createHash('sha256').update(expected).digest()
+  return timingSafeEqual(a, b)
+}

package/server/routes/openai-compat.ts

@@ -13,6 +13,7 @@ import {
 } from '../lib/codex-model-catalog.js'
 import { tryInstantResponse } from '../lib/response-cache.js'
 import crypto from 'node:crypto'
+import { timingSafeTokenEqual } from '../lib/token-auth.js'
 
 export const openaiCompatRouter = Router()
 
@@ -66,7 +67,7 @@ function validateAuth(req: any, res: any): boolean {
   }
 
   const token = auth.slice(7)
-  if (token !== cosToken) {
+  if (!timingSafeTokenEqual(token, cosToken)) {
     res.status(401).json({ error: { message: 'Invalid token', type: 'invalid_request_error' } })
     return false
   }