--- title: Timing Attacks on Node.js | daily.dev description: A developer recounts discovering that comparing password strings with a plain equality check in a Node.js/Fastify API creates a timing attack vulnerability,... canonical: https://daily.dev/posts/timing-attacks-on-node-js-gwnbbjabp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Timing Attacks on Node.js | daily.dev og:description: A developer recounts discovering that comparing password strings with a plain equality check in a Node.js/Fastify API creates a timing attack vulnerability,... og:url: https://daily.dev/posts/timing-attacks-on-node-js-gwnbbjabp og:image: https://api.daily.dev/og/posts/GWNbbjABp.png og:image:alt: Timing Attacks on Node.js og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Timing Attacks on Node.js **[Yagiz Nizipli](https://daily.dev/sources/yagiz)** · 3 min read · 0 upvotes · 0 comments ## Summary A developer recounts discovering that comparing password strings with a plain equality check in a Node.js/Fastify API creates a timing attack vulnerability, despite eslint-plugin-security flagging it only via variable name matching (a false positive in terms of actual security reasoning). The piece explains what timing attacks are, how they exploit execution time correlated with input, and shows using Node's crypto.timingSafeEqual(a, b) as the constant-time comparison function intended for secrets like HMAC digests or auth cookies—while noting that for a simple password-confirmation check (not comparing hashes), using it is technically unnecessary and adds overhead. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I safely compare two secret strings in Node.js to avoid timing attacks? Use the crypto.timingSafeEqual(a, b) function from Node's built-in crypto module. It implements a constant-time algorithm that returns true if a equals b without leaking timing information an attacker could use to guess the value. It is intended for comparing HMAC digests, authentication cookies, or capability URLs rather than plain strings like a re-entered password. _daily.dev surfaces practical write-ups like this for developers hardening authentication flows against side-channel risks._ ### Does eslint-plugin-security actually detect timing attack vulnerabilities in JavaScript code? Not reliably. The plugin flags comparisons based on the variable name containing 'password' rather than analyzing whether the comparison is actually a security-sensitive equality check, producing false positives and missing the real underlying issue of non-constant-time string comparison. Developers still need to manually reason about which comparisons handle secrets. _Developers relying on linters for security checks can find these gaps discussed across daily.dev before shipping code._ ### Is it necessary to use timingSafeEqual when checking that a user's password and password confirmation match during a password reset? No, it is unnecessary and adds unwanted overhead. timingSafeEqual is meant for comparing cryptographic values like hashes, HMAC digests, or secret tokens where timing leakage could help an attacker guess a secret; comparing two plaintext fields entered by the same user, like password and password_again, does not carry that risk. _daily.dev helps developers weighing when cryptographic safeguards are worth the cost in everyday API code._ ## Similar posts on daily.dev - [How to Build Secure-by-Default Node.js APIs](https://daily.dev/posts/how-to-build-secure-by-default-node-js-apis-kgzyotifm) · freeCodeCamp · 10 upvotes · 0 comments - [A Practical Guide to Secure Authentication for Developers](https://daily.dev/posts/a-practical-guide-to-secure-authentication-for-developers-p5rufwxgq) · SitePoint · 0 upvotes · 0 comments - [Most JavaScript Developers Get == Wrong in Interviews \(Not Because It's Hard\)](https://daily.dev/posts/most-javascript-developers-get-wrong-in-interviews-not-because-it-s-hard--i6iheuzwh) · Medium · 1 upvotes · 0 comments - [The V8 JavaScript Runtime Undermined My Constant-Time JavaScript Library](https://daily.dev/posts/the-v8-javascript-runtime-undermined-my-constant-time-javascript-library-g9jlr7qsx) · Dhole Moments · 6 upvotes · 2 comments - [non-constant-time HMAC comparison in Paddle Billing webhook signature verifier](https://daily.dev/posts/non-constant-time-hmac-comparison-in-paddle-billing-webhook-signature-verifier-lwampel5h) · RUBYLAND · 0 upvotes · 0 comments --- Tags: [#javascript](https://daily.dev/tags/javascript), [#nodejs](https://daily.dev/tags/nodejs), [#cryptography](https://daily.dev/tags/cryptography), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/timing-attacks-on-node-js-gwnbbjabp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Timing Attacks on Node.js","url":"https://daily.dev/posts/timing-attacks-on-node-js-gwnbbjabp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/timing-attacks-on-node-js-gwnbbjabp"},"datePublished":"2026-09-13T19:57:37.139Z","dateModified":"2026-09-13T20:02:32.293Z","description":"A developer recounts discovering that comparing password strings with a plain equality check in a Node.js/Fastify API creates a timing attack vulnerability,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9ee4949f71038c82e941cc79ef74dddd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9ee4949f71038c82e941cc79ef74dddd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Yagiz Nizipli","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Yagiz Nizipli","logo":"https://media.daily.dev/image/upload/s--9Cscmaqk--/f_auto,q_auto/v1789329427/logos/yagiz?_a=BAMAMicg0","url":"https://daily.dev/sources/yagiz"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/timing-attacks-on-node-js-gwnbbjabp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"javascript,nodejs,cryptography,appsec","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Yagiz Nizipli","item":"https://daily.dev/sources/yagiz"},{"@type":"ListItem","position":3,"name":"Timing Attacks on Node.js"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/timing-attacks-on-node-js-gwnbbjabp#faq","mainEntity":[{"@type":"Question","name":"How do I safely compare two secret strings in Node.js to avoid timing attacks?","acceptedAnswer":{"@type":"Answer","text":"Use the crypto.timingSafeEqual(a, b) function from Node's built-in crypto module. It implements a constant-time algorithm that returns true if a equals b without leaking timing information an attacker could use to guess the value. It is intended for comparing HMAC digests, authentication cookies, or capability URLs rather than plain strings like a re-entered password. daily.dev surfaces practical write-ups like this for developers hardening authentication flows against side-channel risks."}},{"@type":"Question","name":"Does eslint-plugin-security actually detect timing attack vulnerabilities in JavaScript code?","acceptedAnswer":{"@type":"Answer","text":"Not reliably. The plugin flags comparisons based on the variable name containing 'password' rather than analyzing whether the comparison is actually a security-sensitive equality check, producing false positives and missing the real underlying issue of non-constant-time string comparison. Developers still need to manually reason about which comparisons handle secrets. Developers relying on linters for security checks can find these gaps discussed across daily.dev before shipping code."}},{"@type":"Question","name":"Is it necessary to use timingSafeEqual when checking that a user's password and password confirmation match during a password reset?","acceptedAnswer":{"@type":"Answer","text":"No, it is unnecessary and adds unwanted overhead. timingSafeEqual is meant for comparing cryptographic values like hashes, HMAC digests, or secret tokens where timing leakage could help an attacker guess a secret; comparing two plaintext fields entered by the same user, like password and password_again, does not carry that risk. daily.dev helps developers weighing when cryptographic safeguards are worth the cost in everyday API code."}}]} ```