arcanajs 6.1.0-beta.3 → 6.1.0

package/dist/development/arcanajs.js

@@ -2429,6 +2429,28 @@ function _interop_require_default(obj) {
     };
 }
 const CSRF_COOKIE_NAME = "_csrf";
+/**
+ * Timing-safe CSRF token comparison to prevent timing attacks
+ * This ensures that token validation takes constant time regardless of where
+ * the tokens differ, preventing attackers from using timing analysis to
+ * guess valid tokens character by character.
+ */ function isValidCsrfToken(providedToken, expectedToken) {
+    // Ensure both tokens are the same length to prevent timing attacks
+    // If lengths differ, we still perform a comparison to maintain constant time
+    if (providedToken.length !== expectedToken.length) {
+        // Create a dummy token of the same length as expected for constant-time comparison
+        const dummyToken = "0".repeat(expectedToken.length);
+        _crypto.default.timingSafeEqual(Buffer.from(dummyToken), Buffer.from(expectedToken));
+        return false;
+    }
+    try {
+        // Perform constant-time comparison of the tokens
+        return _crypto.default.timingSafeEqual(Buffer.from(providedToken), Buffer.from(expectedToken));
+    } catch (error) {
+        // If buffer conversion fails, tokens are invalid
+        return false;
+    }
+}
 const createCsrfMiddleware = ()=>{
     return (req, res, next)=>{
         // 1. Generate or retrieve token
@@ -2452,7 +2474,14 @@ const createCsrfMiddleware = ()=>{
             "PATCH"
         ].includes(method)) {
             const headerToken = req.headers["x-csrf-token"];
-            if (!headerToken || headerToken !== token) {
+            // Validate token exists and is a string
+            if (!headerToken || typeof headerToken !== "string") {
+                return res.status(403).json({
+                    error: "Invalid CSRF Token"
+                });
+            }
+            // Use timing-safe comparison to prevent timing attacks
+            if (!isValidCsrfToken(headerToken, token)) {
                 return res.status(403).json({
                     error: "Invalid CSRF Token"
                 });