From 058de8089cbf8953679830b20db3effeba5d3e68 Mon Sep 17 00:00:00 2001 From: Markus Graf Date: Thu, 18 Jun 2026 15:23:57 +0200 Subject: [PATCH] fix: use constant-time comparison for API key --- api/main.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/api/main.py b/api/main.py index 9ac29d9..1890c37 100644 --- a/api/main.py +++ b/api/main.py @@ -1,3 +1,4 @@ +import hmac import os from fastapi import FastAPI, Depends, HTTPException, Security from fastapi.security.api_key import APIKeyHeader @@ -18,7 +19,7 @@ def get_api_key(api_key_header: str = Security(api_key_header)): # If no key is configured, deny all requests for safety raise HTTPException(status_code=500, detail="API_KEY not configured on server") - if api_key_header == expected_api_key: + if hmac.compare_digest(api_key_header or "", expected_api_key): return api_key_header raise HTTPException(status_code=401, detail="Invalid or missing API Key")