6 min read

When timingSafeEqual Isn't: A One-Line Auth Bypass

I wrote a timing-safe string comparison function for API key auth. It had a bug where every string compared equal to every other string. The fix was one line — but finding it took 143 tests.

#edgemail #security #authentication #cloudflare-workers #testing