fix: Use constant-time comparison for token lookup

CHANGELOG.md

@@ -1,5 +1,9 @@
 ## [Unreleased]
 
+## [0.9.1] (2026-02-17)
+### Fixed
+* Use constant-time comparison (`Plug.Crypto.secure_compare/2`) for token lookup to prevent timing attacks
+
 ## [0.9.0] (2025-07-17)
 ### Changed
 * Added ability to optionally add a realm to the simple auth. Allowing services to use the plug multiple times

lib/simple_token_authentication.ex

@@ -22,17 +22,25 @@ defmodule SimpleTokenAuthentication do
           val
       end
 
-    if service_name = token_map[val] do
-      Logger.metadata(service_name: service_name)
-      assign(conn, :simple_token_auth_service, service_name)
-    else
-      conn
-      |> put_resp_content_type("application/json")
-      |> send_resp(401, ~s({ "error": "Invalid shared key" }))
-      |> halt()
+    case secure_lookup(token_map, val) do
+      {:ok, service_name} ->
+        Logger.metadata(service_name: service_name)
+        assign(conn, :simple_token_auth_service, service_name)
+
+      :error ->
+        conn
+        |> put_resp_content_type("application/json")
+        |> send_resp(401, ~s({ "error": "Invalid shared key" }))
+        |> halt()
     end
   end
 
+  defp secure_lookup(token_map, val) do
+    Enum.find_value(token_map, :error, fn {token, service_name} ->
+      if Plug.Crypto.secure_compare(token, val), do: {:ok, service_name}
+    end)
+  end
+
   defp get_auth_header(conn) do
     case get_req_header(conn, "authorization") do
       [val | _] -> val

mix.exs

@@ -2,7 +2,7 @@ defmodule SimpleTokenAuthentication.Mixfile do
   use Mix.Project
 
   @source_url "https://github.com/podium/simple_token_authentication"
-  @version "0.9.0"
+  @version "0.9.1"
 
   def project do
     [