So, I'm authing a pretty short list of users for a mostly private server, and the login data for these users in stored in an object. The object is structured like {"username":"hash"}. I'd like to know if using something like if(users[username) {timingSafeCompare(hash,users[username])}
is considered timing safe.
I thought of using something like
let u = false
for(un in users) {
if(timingSafeCompare(username,un) && timingSafeCompare(hash,users[un])) u = username
}
return u
But again, I'm not sure if that's timing safe.
What would be the best approach to this?