dound/gae-sessions — pull request #47 by cdman (2013-09-24 18:09:01+00:00)
Title: Fix timing attack

Makes HMAC comparison to avoid potential timing attacks. A timing attack would allow an attacker to "craft" (trough a series of requests) a valid HMAC for any cookie. Here is a good introduction to them: http://codahale.com/a-lesson-in-timing-attacks/

Note: I was unable to exploit the flaw either locally or in a production setup (even tried using a high-quality datacenter network), but that doesn't mean that someone smarter couldn't :sparkles: