fix(auth): use subtle for constant time key comparison, fix lower case key issue (#526)

* use subtle for constant time key comparison, fix lower case key issue

Author: JannikSt

Cargo.lock

@@ -35,3 +35,4 @@ async-trait = "0.1.88"
 regex = "1.11.1"
 iroh = { workspace = true }
 rand_v8 = { workspace = true }
+subtle = "2.6.1"

crates/shared/Cargo.toml

@@ -5,6 +5,7 @@ use actix_web::{
     Error,
 };
 use futures_util::future::{ready, LocalBoxFuture, Ready};
+use subtle::ConstantTimeEq;
 
 pub struct ApiKeyMiddleware {
     api_key: String,
@@ -56,16 +57,160 @@ where
     fn call(&self, req: ServiceRequest) -> Self::Future {
         if let Some(auth_header) = req.headers().get(AUTHORIZATION) {
             if let Ok(auth_str) = auth_header.to_str() {
-                if auth_str.to_lowercase() == format!("bearer {}", self.api_key) {
-                    let fut = self.service.call(req);
-                    return Box::pin(async move {
-                        let res = fut.await?;
-                        Ok(res)
-                    });
+                if auth_str.len() > 7 {
+                    let (scheme, key) = auth_str.split_at(7);
+                    if scheme.eq_ignore_ascii_case("Bearer ") {
+                        let provided_key_bytes = key.as_bytes();
+                        let expected_key_bytes = self.api_key.as_bytes();
+
+                        if provided_key_bytes.len() == expected_key_bytes.len()
+                            && provided_key_bytes.ct_eq(expected_key_bytes).into()
+                        {
+                            let fut = self.service.call(req);
+                            return Box::pin(async move {
+                                let res = fut.await?;
+                                Ok(res)
+                            });
+                        }
+                    }
                 }
             }
         }
 
         Box::pin(async move { Err(ErrorUnauthorized("Invalid API key")) })
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use actix_web::{test, web, App, HttpResponse};
+
+    async fn test_handler() -> HttpResponse {
+        HttpResponse::Ok().body("Success")
+    }
+
+    #[actix_web::test]
+    async fn test_valid_api_key() {
+        let api_key = "test-api-key";
+        let app = test::init_service(
+            App::new()
+                .wrap(ApiKeyMiddleware::new(api_key.to_string()))
+                .route("/", web::get().to(test_handler)),
+        )
+        .await;
+
+        let req = test::TestRequest::get()
+            .uri("/")
+            .insert_header(("Authorization", "Bearer test-api-key"))
+            .to_request();
+
+        let resp = test::call_service(&app, req).await;
+        assert!(resp.status().is_success());
+    }
+
+    #[actix_web::test]
+    async fn test_invalid_api_key() {
+        let api_key = "test-api-key";
+        let app = test::init_service(
+            App::new()
+                .wrap(ApiKeyMiddleware::new(api_key.to_string()))
+                .route("/", web::get().to(test_handler)),
+        )
+        .await;
+
+        let req = test::TestRequest::get()
+            .uri("/")
+            .insert_header(("Authorization", "Bearer wrong-key"))
+            .to_request();
+
+        let resp = app.call(req).await;
+        assert!(resp.is_err());
+        assert_eq!(resp.unwrap_err().to_string(), "Invalid API key");
+    }
+
+    #[actix_web::test]
+    async fn test_missing_auth_header() {
+        let api_key = "test-api-key";
+        let app = test::init_service(
+            App::new()
+                .wrap(ApiKeyMiddleware::new(api_key.to_string()))
+                .route("/", web::get().to(test_handler)),
+        )
+        .await;
+
+        let req = test::TestRequest::get().uri("/").to_request();
+
+        let resp = app.call(req).await;
+        assert!(resp.is_err());
+        assert_eq!(resp.unwrap_err().to_string(), "Invalid API key");
+    }
+
+    #[actix_web::test]
+    async fn test_lowercase_bearer_accepted() {
+        let api_key = "test-API-key";
+        let app = test::init_service(
+            App::new()
+                .wrap(ApiKeyMiddleware::new(api_key.to_string()))
+                .route("/", web::get().to(test_handler)),
+        )
+        .await;
+
+        let req = test::TestRequest::get()
+            .uri("/")
+            .insert_header(("Authorization", "bearer test-API-key"))
+            .to_request();
+
+        let resp = test::call_service(&app, req).await;
+        assert!(resp.status().is_success());
+
+        let req = test::TestRequest::get()
+            .uri("/")
+            .insert_header(("Authorization", "bearer test-api-key"))
+            .to_request();
+
+        let resp = app.call(req).await;
+        assert!(resp.is_err());
+        assert_eq!(resp.unwrap_err().to_string(), "Invalid API key");
+    }
+
+    #[actix_web::test]
+    async fn test_mixed_case_api_key_rejected() {
+        let api_key = "test-api-key";
+        let app = test::init_service(
+            App::new()
+                .wrap(ApiKeyMiddleware::new(api_key.to_string()))
+                .route("/", web::get().to(test_handler)),
+        )
+        .await;
+
+        let req = test::TestRequest::get()
+            .uri("/")
+            .insert_header(("Authorization", "BeArEr test-API-key"))
+            .to_request();
+
+        let resp = app.call(req).await;
+        assert!(resp.is_err());
+        assert_eq!(resp.unwrap_err().to_string(), "Invalid API key");
+    }
+
+    #[actix_web::test]
+    async fn test_malformed_auth_header() {
+        let api_key = "test-api-key";
+        let app = test::init_service(
+            App::new()
+                .wrap(ApiKeyMiddleware::new(api_key.to_string()))
+                .route("/", web::get().to(test_handler)),
+        )
+        .await;
+
+        let req = test::TestRequest::get()
+            .uri("/")
+            .insert_header(("Authorization", "InvalidFormat"))
+            .to_request();
+
+        let resp = app.call(req).await;
+        assert!(resp.is_err());
+        assert_eq!(resp.unwrap_err().to_string(), "Invalid API key");
+    }
+}