constantTimeCompare

1/**
2 * Compares two strings in constant time to prevent timing attacks.
3 *
4 * @param a - First string to compare.
5 * @param b - Second string to compare.
6 * @returns True if strings are equal, false otherwise.
7 */
8export function constantTimeCompare(a: string, b: string): boolean {
9  if (a.length !== b.length) return false;
10
11  let result = 0;
12  for (let i = 0; i < a.length; i++) {
13    result |= a.charCodeAt(i) ^ b.charCodeAt(i);
14  }
15
16  return result === 0;
17}

1test('returns true for equal strings', () => {
2  expect(constantTimeCompare('secure', 'secure')).toBe(true);
3});
4
5test('returns false for different strings', () => {
6  expect(constantTimeCompare('secure', 'insecure')).toBe(false);
7});
8
9test('returns false for strings with same prefix', () => {
10  expect(constantTimeCompare('token123', 'tokenXYZ')).toBe(false);
11});
12
13test('returns false for strings with different lengths', () => {
14  expect(constantTimeCompare('abc', 'abcd')).toBe(false);
15});
16
17test('returns true for empty strings', () => {
18  expect(constantTimeCompare('', '')).toBe(true);
19});