Function isValidLegacyKey

core/http/auth/middleware.go:540–547

isValidLegacyKey checks if the key matches any configured API key using constant-time comparison to prevent timing attacks.

(key string, appConfig *config.ApplicationConfig)

// isValidLegacyKey checks if the key matches any configured API key
// using constant-time comparison to prevent timing attacks.
func isValidLegacyKey(key string, appConfig *config.ApplicationConfig) bool {
	for _, validKey := range appConfig.ApiKeys {
		if subtle.ConstantTimeCompare([]byte(key), []byte(validKey)) == 1 {
			return true
		}
	}
	return false
}

// isExemptPath returns true if the path should skip authentication.
func isExemptPath(path string, appConfig *config.ApplicationConfig) bool {