From b01605bb5b43dbf33781970af5ad6633e5549fd1 Mon Sep 17 00:00:00 2001
From: Snawoot <vladislav-ex-github@vm-0.com>
Date: Wed, 13 Jan 2021 03:40:37 +0200
Subject: [PATCH] basic auth: fix timing oracle (#2609)

Co-authored-by: thinkerou <thinkerou@gmail.com>
---
 auth.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/auth.go b/auth.go
index 43ad36f53b..4d8a6ce484 100644
--- a/auth.go
+++ b/auth.go
@@ -5,6 +5,7 @@
 package gin
 
 import (
+	"crypto/subtle"
 	"encoding/base64"
 	"net/http"
 	"strconv"
@@ -30,7 +31,7 @@ func (a authPairs) searchCredential(authValue string) (string, bool) {
 		return "", false
 	}
 	for _, pair := range a {
-		if pair.value == authValue {
+		if subtle.ConstantTimeCompare([]byte(pair.value), []byte(authValue)) == 1 {
 			return pair.user, true
 		}
 	}