fix: use hmac.compare_digest for constant-time credential comparison in auth_svc#3297

Closed

deacon-mp wants to merge 3 commits into

fix/compare-digest-timing-fix

Commits on Mar 15, 2026

fix: use compare_digest() for all API key comparisons in auth_svc
deacon-mp
committed

Commits on Mar 16, 2026

fix: address Copilot review feedback
deacon-mp
committed
Address Copilot review: use _ensure_str() to properly decode bytes before compare_digest, add bytes config test
deacon-mp
committed