Timing Vulnerability

[jder]

I think the equality comparison on this line needs to be constant-time to avoid a timing vulnerability:

nginx-google-oauth/access.lua

Line 58 in c01b230

if oauth_access_token == expected_token and oauth_expires and oauth_expires > ngx.time() then

Currently, an attacker could choose an arbitrary email and expiry date and use the time taken by the equality check to find the correct value for oauth_access_token. They would then be logged in as the targeted email address. It seems like this would probably take days/weeks of sustained traffic to pull off.