aws-samples / aws-samples/apigateway-http-api-access-control

Improve resistance against timing attacks in authorizerLambda

Open
#1 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
7
Forks
4
PR merge metrics
No merged PRs in 30d

Description

Thank you for your work on this sample!!!!

As an **improvement**, I suggest using `secrets` python module in order to improve resistance against timing attacks.

In particular when the `authorizerLambda` checks if the `x-origin-verify` header value is equal to the secret value using `==` there is a vulnerability to timing attacks that can be solved by importing the `secrets` python module and rewriting the following part of the lambda:

```python
if (event['headers']['x-origin-verify'] == secret_HeaderValue or event['headers']['x-origin-verify'] == pending_secret_HeaderValue):
response={
"isAuthorized":True
}
```

in this way

```python
if (secrets.compare_digest(event['headers']['x-origin-verify'], secret_HeaderValue) or secrets.compare_digest(event['headers']['x-origin-verify'], pending_secret_HeaderValue)):
response={
"isAuthorized":True
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.