AWS logo
Amazon QDetector Library

Timing attack High

Operators like == and === are not time-safe and can make your application vulnerable to a timing attack, which might enable attackers to infer security-sensitive information.

Detector ID
javascript/timing-attack@v1.0
Category
Common Weakness Enumeration (CWE) external icon

Noncompliant example

1var express = require('express')
2var app = express()
3
4function timingAttackNoncompliant() {
5    app.get('/user/login', function (req, res) {
6        // Noncompliant: '===' operator is used with sensitive data field.
7        if(password === "myPass") {
8            logIn()
9        }
10    })
11}

Compliant example

1var express = require('express')
2var app = express()
3var compare = require('secure-compare')
4
5function timingAttackCompliant() {
6    app.get('/user/login', function (req, res) {
7        // Compliant: sensitive data field is compared using 'secure-compare'.
8        if(compare(password, "myPass")) {
9            logIn()
10        }
11    })
12}