Github/authentik
1
0
Fork 0
mirror of https://github.com/goauthentik/authentik.git synced 2026-08-30 18:51:39 -07:00
Code Issues Packages Projects Releases Wiki Activity

rbac: use constant-time comparison in SecretKeyFilter (#24888)

Browse Source
This commit is contained in:
Bunlong Heng
2026-08-10 09:07:43 -04:00
committed by GitHub
parent 506ec5ca72
commit 28a07c7eb0
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
authentik/rbac/filters.py
View File

@@ -1,5 +1,7 @@
"""RBAC API Filter"""
from hmac import compare_digest
from django.conf import settings
from django.db.models import QuerySet
from django_filters.rest_framework import DjangoFilterBackend
@@ -103,7 +105,7 @@ class SecretKeyFilter(DjangoFilterBackend):
def filter_queryset(self, request: Request, queryset: QuerySet, view) -> QuerySet:
auth_header = get_authorization_header(request)
token = validate_auth(auth_header)
if token and token == settings.SECRET_KEY:
if token and compare_digest(token, settings.SECRET_KEY):
return queryset
queryset = ObjectFilter().filter_queryset(request, queryset, view)
return super().filter_queryset(request, queryset, view)