Node.js · Middle · Question 45 of 75

How should you compare a secret token from a request with the stored one?

✓Correct answer: With crypto.timingSafeEqual on equal-length buffers
2With localeCompare
3With ===

Explanation

=== stops at the first different character, so response time can leak how much of the token was correct. A constant-time comparison avoids that.

Further reading

Node.js API: Crypto ↗

Test yourself

Take the Node.js · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.