Compares a presented token against the stored one in constant time.
A === on a secret leaks its prefix through timing, and this one guards a whole-database dump.
The length check is deliberately NOT an early return on mismatch -- it folds the lengths into the
same accumulator so a wrong-length guess costs the same as a wrong-value one.
Compares a presented token against the stored one in constant time.
A
===on a secret leaks its prefix through timing, and this one guards a whole-database dump. The length check is deliberately NOT an early return on mismatch -- it folds the lengths into the same accumulator so a wrong-length guess costs the same as a wrong-value one.