INNER CODE UNIT · JavaScript

timingSafeEqual

aeonfun/opendia · opendia-mcp/server.js:225

function timingSafeEqual(a, b) {
  const left = Buffer.from(a);
  const right = Buffer.from(b);
  return left.length === right.length && crypto.timingSafeEqual(left, right);
}

function requireToken(req, res, next) {
  if (!AUTH_TOKEN) return next();

  const header = req.headers.authorization || '';
  const provided = header.startsWith('Bearer ') ? header.slice(7) : null;
  if (!provided || !timingSafeEqual(provided, AUTH_TOKEN)) {
    console.error(`🚫 Rejected ${req.method} ${req.path} — missing or bad token`);
    return res.status(401).json({ error: 'Unauthorized' });
  }
  return next();
}

View source record →