keystonejs/keystone — pull request #701 by Mickael-van-der-Beek (2014-11-07 00:45:31+00:00)
Title: Fixes two timing attack vulnerabilities

Fixes two timing attack vulnerabilities that occurred when:

- comparing password hashes
- comparing CSRF token hashes

The solution employed here is to use the "scmp" NPM module that does char-per-char string comparisons in a constant time.