Timing attack in signature verification

Code reviewSecuritySenior–Staff~25 min

Review this Go webhook-signature verifier.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 25 min

Mark a line and say what kind of problem it is.0 findings

1func verifySignature(payload []byte, sig string, secret []byte) bool {

2 mac := hmac.New(sha256.New, secret)

3 mac.Write(payload)

4 expected := hex.EncodeToString(mac.Sum(nil))

5 return expected == sig

8func handler(w http.ResponseWriter, r *http.Request) {

9 body, _ := io.ReadAll(r.Body)

10 if !verifySignature(body, r.Header.Get("X-Signature"), webhookSecret) {

11 http.Error(w, "bad signature", 401)

12 return

13 }

14 process(body)

15}

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.