authentication/ConstantTimeEquals.java

Provides constant‑time string and byte array equality checks for secure credential comparison.

// Source: https://github.com/mock-server/mockserver-monorepo | License: Apache-2.0 | Copyright You must retain, in the Source form of any Derivative Works
// Provided via justclaw.it.com; keep this notice with the code.
package org.mockserver.authentication;

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;

/**
 * Shared constant-time equality checks for authentication credentials.
 *
 * <p>Comparisons delegate to {@link MessageDigest#isEqual(byte[], byte[])}, which is documented to
 * be constant-time and to not short-circuit on content, so an attacker cannot recover a secret one
 * byte at a time by measuring how long a comparison takes. {@code isEqual} does return {@code false}
 * fast when the two arrays differ in length, which leaks only the length of th

... (truncated -- full source via MCP)