From 82b918e10d13eeb80be88182a6c2b2678728f803 Mon Sep 17 00:00:00 2001
From: Alex Brasetvik <alex@brasetvik.com>
Date: Fri, 19 Feb 2021 11:16:41 +0100
Subject: [PATCH] Constant time comparison of auth key (#1847)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

… to avoid [timing attacks](https://codahale.com/a-lesson-in-timing-attacks/).
---
 patroni/api.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/patroni/api.py b/patroni/api.py
index e3fbb986..06be43ef 100644
--- a/patroni/api.py
+++ b/patroni/api.py
@@ -1,4 +1,5 @@
 import base64
+import hmac
 import json
 import logging
 import psycopg2
@@ -558,7 +559,7 @@ class RestApiServer(ThreadingMixIn, HTTPServer, Thread):
             fcntl.fcntl(fd, fcntl.F_SETFD, flags | fcntl.FD_CLOEXEC)
 
     def check_basic_auth_key(self, key):
-        return self.__auth_key == key
+        return hmac.compare_digest(self.__auth_key, key.encode('utf-8'))
 
     def check_auth_header(self, auth_header):
         if self.__auth_key:
@@ -688,7 +689,7 @@ class RestApiServer(ThreadingMixIn, HTTPServer, Thread):
         if self.__listen != config['listen'] or self.__ssl_options != ssl_options:
             self.__initialize(config['listen'], ssl_options)
 
-        self.__auth_key = base64.b64encode(config['auth'].encode('utf-8')).decode('utf-8') if 'auth' in config else None
+        self.__auth_key = base64.b64encode(config['auth'].encode('utf-8')) if 'auth' in config else None
         self.connection_string = uri(self.__protocol, config.get('connect_address') or self.__listen, 'patroni')
 
     @staticmethod