gurix/wecker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: use constant-time comparison for API key

Browse Source
This commit is contained in:
gurix
2026-06-18 15:23:57 +02:00
parent 124a6a4916
commit 058de8089c
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/main.py
+2 -1
View File
@@ -1,3 +1,4 @@
import hmac
import os import os
from fastapi import FastAPI, Depends, HTTPException, Security from fastapi import FastAPI, Depends, HTTPException, Security
from fastapi.security.api_key import APIKeyHeader from fastapi.security.api_key import APIKeyHeader
@@ -18,7 +19,7 @@ def get_api_key(api_key_header: str = Security(api_key_header)):
# If no key is configured, deny all requests for safety # If no key is configured, deny all requests for safety
raise HTTPException(status_code=500, detail="API_KEY not configured on server") raise HTTPException(status_code=500, detail="API_KEY not configured on server")
if api_key_header == expected_api_key: if hmac.compare_digest(api_key_header or "", expected_api_key):
return api_key_header return api_key_header
raise HTTPException(status_code=401, detail="Invalid or missing API Key") raise HTTPException(status_code=401, detail="Invalid or missing API Key")