AWS logo
Amazon QDetector Library

Timing attack High

Operators like == and === are not time-safe and can make your application vulnerable to a timing attack, which might enable attackers to infer security-sensitive information.

Detector ID
typescript/timing-attack@v1.0
Category
Common Weakness Enumeration (CWE) external icon

Noncompliant example

1import express, {Request, Response} from 'express'
2var app = express()
3const password = "myPass";
4function timingAttackNoncompliant() {
5  app.get("/user/login", function (req: Request, res: Response) {
6    // Noncompliant: '===' operator is used with sensitive data field.
7    if (password === "myPass") {
8      // logIn()
9    }
10  });
11}

Compliant example

1import express, {Request, Response} from 'express'
2var app = express()
3var compare = require("secure-compare");
4function timingAttackCompliant() {
5  app.get("/user/login", function (req: Request, res: Response) {
6    // Compliant: sensitive data field is compared using 'secure-compare'.
7    if (compare(password, "myPass")) {
8      //
9    }
10  });
11}