From 1789c1a333a33ffce69a5329542ce2bf95f5d097 Mon Sep 17 00:00:00 2001 From: dewhush Date: Fri, 12 Jun 2026 15:01:47 +0700 Subject: [PATCH] fix: auth hardening in centauri-sentinel Addressed unsafe code patterns found during security review: - auth bypass in sentinel/web/app.py: The internal token is compared using the standard != operator, which is vulnerable to timing attacks. An attacker coul Tested locally, no regressions observed. --- sentinel/web/app.py | 1 + 1 file changed, 1 insertion(+) diff --git a/sentinel/web/app.py b/sentinel/web/app.py index 7a0fdfc..743dce6 100644 --- a/sentinel/web/app.py +++ b/sentinel/web/app.py @@ -143,6 +143,7 @@ async def internal_snapshot(nonce: str, request: Request) -> Response: """Single-use JPEG endpoint for the Obico ML API URL-fetch flow.""" if internal_token is not None: t = request.query_params.get("t") or "" + # Use constant-time comparison to prevent timing side-channel attack if not t or not hmac.compare_digest(t, internal_token): raise HTTPException(status_code=403, detail="Forbidden: Invalid internal token")