fix: constant-time comparison for share tokens

Applies the reviewer's suggestion on app/auth.py — hmac was already imported.
2026-08-18 13:00:08 +00:00
parent a1aefa08c7
commit 4e1285dc96
1 changed files with 1 additions and 1 deletions
@@ -35,4 +35,4 @@ def make_share_token(note_id: int) -> str:
 def check_share_token(supplied: str, expected: str) -> bool:
    """Validate a share token supplied in a URL."""
-    return supplied == expected
+    return hmac.compare_digest(supplied, expected)