Andrey Antukh f4cf6f46f8

🐛 Use constant-time comparison for management API shared key auth (#11534) ...

The management API shared-key-auth middleware was using the standard = operator for key comparison, which is vulnerable to timing attacks. The RPC middleware already uses constant-time comparison via MessageDigest/isEqual.

This change:
- Makes constant-time-eq? public in app.http.middleware
- Updates app.http.management/shared-key-auth to use mw/constant-time-eq?
- Fixes an inconsistency where the nil-key branch returned a 2-arg function
- Adds comprehensive tests for the management shared-key-auth middleware

Closes #11426

AI-assisted-by: qwen3.7-plus

2026-09-14 13:26:16 +02:00

..

backend_tests

🐛 Use constant-time comparison for management API shared key auth (#11534)

2026-09-14 13:26:16 +02:00

e2e

🐛 Escape LDAP filter values and use directory email in retrieve-user (#11085)

2026-09-10 16:39:35 +02:00