Constant time to protect against timing attacks

README.md

@@ -71,6 +71,7 @@ return `true` or `false` to indicate that the credentials were approved or not:
 app.use(basicAuth( { authorizer: myAuthorizer } ))
 
 function myAuthorizer(username, password) {
+    // Take care to use a timing attack safe compare function in real code
     return username.startsWith('A') && password.startsWith('secret')
 }
 ```
@@ -79,6 +80,31 @@ This will authorize all requests with credentials where the username begins with
 `'A'` and the password begins with `'secret'`. In an actual application you would
 likely look up some data instead ;-)
 
+### Timing attacks
+
+When using a custom validation callback, even when comparing hashes, make sure
+to **avoid standard string compare (`==`)**. Use a "constant time compare
+function". This protects you against [timing
+attacks](https://en.wikipedia.org/wiki/Timing_attack).
+
+For example, using
+[safe-compare](https://www.npmjs.com/package/safe-compare):
+
+```js
+const compare = require('safe-compare');
+app.use(basicAuth( { authorizer: myAuthorizer } ))
+
+function myAuthorizer(username, password) {
+    // Use non-short-circuiting evaluation to ensure constant time comparison
+    return compare("admin", username) & compare("admin-password", password);
+}
+```
+
+To avoid leaking information about the username, a
+non-[short-circuiting](https://en.wikipedia.org/wiki/Short-circuit_evaluation)
+and operator is used; `&`. This guarantees both username and password are always
+compared.
+
 ### Custom Async Authorization
 
 Note that the `authorizer` function above is expected to be synchronous. This is

index.js

@@ -1,5 +1,6 @@
 const auth = require('basic-auth')
 const assert = require('assert')
+const compare = require('safe-compare');
 
 function ensureFunction(option, defaultValue) {
     if(option == undefined)
@@ -24,7 +25,7 @@ function buildMiddleware(options) {
 
     function staticUsersAuthorizer(username, password) {
         for(var i in users)
-            if(username == i && password == users[i])
+            if(compare(username, i) & compare(password, users[i]))
                 return true
 
         return false

package.json

@@ -27,7 +27,8 @@
   },
   "homepage": "/~https://github.com/LionC/express-basic-auth#readme",
   "dependencies": {
-    "basic-auth": "^2.0.1"
+    "basic-auth": "^2.0.1",
+    "safe-compare": "^1.1.3"
   },
   "devDependencies": {
     "@types/express": "^4.16.0",