aws-samples / aws-samples/apigateway-http-api-access-control
Improve resistance against timing attacks in authorizerLambda
- Dominant language
- No language data
- Stars
- 7
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Description
Thank you for your work on this sample!!!!
As an **improvement**, I suggest using `secrets` python module in order to improve resistance against timing attacks.
In particular when the `authorizerLambda` checks if the `x-origin-verify` header value is equal to the secret value using `==` there is a vulnerability to timing attacks that can be solved by importing the `secrets` python module and rewriting the following part of the lambda:
```python
if (event['headers']['x-origin-verify'] == secret_HeaderValue or event['headers']['x-origin-verify'] == pending_secret_HeaderValue):
response={
"isAuthorized":True
}
```
in this way
```python
if (secrets.compare_digest(event['headers']['x-origin-verify'], secret_HeaderValue) or secrets.compare_digest(event['headers']['x-origin-verify'], pending_secret_HeaderValue)):
response={
"isAuthorized":True
}
```
Contributor guide
Assessment
This issue has not been assessed yet.