{"id":22780034,"url":"https://github.com/sitegui/constant-equals","last_synced_at":"2025-03-30T14:15:45.480Z","repository":{"id":19830735,"uuid":"23091938","full_name":"sitegui/constant-equals","owner":"sitegui","description":"=== in constant time for strings","archived":false,"fork":false,"pushed_at":"2015-07-28T19:20:58.000Z","size":264,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-05T16:51:59.845Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sitegui.png","metadata":{"files":{"readme":"README.md","changelog":"HISTORY.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2014-08-19T01:05:25.000Z","updated_at":"2015-07-28T19:05:37.000Z","dependencies_parsed_at":"2022-08-25T23:22:35.978Z","dependency_job_id":null,"html_url":"https://github.com/sitegui/constant-equals","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sitegui%2Fconstant-equals","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sitegui%2Fconstant-equals/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sitegui%2Fconstant-equals/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sitegui%2Fconstant-equals/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sitegui","download_url":"https://codeload.github.com/sitegui/constant-equals/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246326783,"owners_count":20759439,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-11T20:12:06.276Z","updated_at":"2025-03-30T14:15:45.456Z","avatar_url":"https://github.com/sitegui.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Constant Equals\n\n[Timing attacks](http://codahale.com/a-lesson-in-timing-attacks/) are a real threat. A very common pitfall is to compare strings with `===`.\n\n## Why?\nSimply because `a === b` will take more time to execute if they share a bigger prefix. So checking the user input against a target password with `===` will leak how much the attacker got the password right:\n\n![bench](https://raw.githubusercontent.com/sitegui/constant-equals/master/bench.png)\n\nYou can run [the code](https://github.com/sitegui/constant-equals/blob/master/bench.js) yourself.\n\n## The solution\nMake a for that checks every character. Don't try to be smart here :)\n\n## Install\n`npm install constant-equals --save`\n\n## Usage\n```javascript\nvar a = 'a-user-input',\n\tg = 'target-password',\n\teq = require('constant-equals')\nif (eq(a, b)) {\n\tconsole.log('Welcome')\n} else {\n\tconsole.log('Go away!')\n}\n```\n\n`eq()` doesn't do any kind of type conversion, so `eq('12', 12) === false`.\n\n## Arrays\n`eq()` also works for a pair of arrays:\n```javascript\neq(['a', 'array', 'of', 5, 'tags'], ['a', 'array', 'of', 5, 'tags']) === true\n```\n\n### indexOf  and lastIndexOf\nLike native `indexOf()` and `lastIndexOf()` for arrays:\n```js\neq.indexOf(['ab', 'cd', 'cd'], 'cd') === 1\neq.indexOf(['ab', 'cd', 'cd'], 'x') === -1\neq.lastIndexOf(['ab', 'cd', 'cd'], 'cd') === 2\n```\n\nThis will always search all elements in the array, using constant equals for each comparison\n\n## NOTE\nYou should never, ever, store user passwords in plain text. If you think about doing so, you should problably look for modules like [bcrypt](https://www.npmjs.org/package/bcrypt)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsitegui%2Fconstant-equals","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsitegui%2Fconstant-equals","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsitegui%2Fconstant-equals/lists"}