spray/spray — pull request #120 by alambert (2012-06-29 21:10:09+00:00)
Title: Fix timing attack in FromConfigUserPassAuthenticator

FromConfigUserPassAuthenticator uses string equality to compare the expected password to the incoming password; this allows a timing attack that can determine a user's password.

For more information, see http://codahale.com/a-lesson-in-timing-attacks/

I made this change against the v0.9.0 tag since we're running that version.

Thank you!