vh/homepage
1
0
Fork 0
mirror of https://github.com/gethomepage/homepage.git synced 2026-09-28 23:11:17 -07:00
Code Issues Actions 12 Packages Projects Releases Wiki Activity

Security: constant time sha comparison for mcp token, DRY

Browse Source
This commit is contained in:
shamoon
2026-07-13 10:22:44 -07:00
parent 75822f632a
commit b7fb4405e4
4 changed files with 20 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/utils/mcp/homepage-mcp.test.js
+4
View File
@@ -626,5 +626,9 @@ describe("utils/mcp/homepage-mcp", () => {
expect(mod.mcpTokenAuthorized({ headers: { authorization: "Bearer secret" } })).toBe(true);
expect(mod.mcpTokenAuthorized({ headers: { "x-homepage-mcp-token": "secret" } })).toBe(true);
expect(mod.mcpTokenAuthorized({ headers: { authorization: "Bearer wrong" } })).toBe(false);
process.env.HOMEPAGE_MCP_TOKEN = "é";
expect(mod.mcpTokenAuthorized({ headers: { authorization: "Bearer a" } })).toBe(false);
expect(mod.mcpTokenAuthorized({ headers: { authorization: "Bearer é" } })).toBe(true);
});
});