Web Security · Senior · Question 40 of 75

How should a service compare a provided API key or HMAC signature with the expected value?

✓Correct answer: With a constant-time comparison such as crypto.timingSafeEqual
2By comparing the first 8 characters
3With ===, because it's the fastest

Explanation

Early-exit comparison leaks how many leading characters match through timing, which can allow byte-by-byte guessing.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.