Function ConstantTimeCompare

Modules/RESTAPI/src/mitkRestServer.cpp:88–98

* @brief Constant-time string comparison to prevent timing attacks. * * Uses OpenSSL's CRYPTO_memcmp for guaranteed constant-time behavior. */

   * Uses OpenSSL's CRYPTO_memcmp for guaranteed constant-time behavior.
   */
  bool ConstantTimeCompare(const std::string& a, const std::string& b)
  {
    // Compare in constant time to avoid leaking token length through timing.
    // XOR of sizes is non-zero if they differ; CRYPTO_memcmp compares up to
    // min(len) bytes. The combined result is zero only when both size and
    // content match exactly.
    volatile size_t result = a.size() ^ b.size();
    const size_t len = std::min(a.size(), b.size());
    result |= static_cast<size_t>(CRYPTO_memcmp(a.data(), b.data(), len));
    return result == 0;
  }

  /**
   * @brief Check if a request path is exempt from authentication.