wake-lambda: wake token comparison is not constant-time #123

Activity

1. royosherove

   added

   bugSomething isn't workingSomething isn't working

   on Oct 11, 2026
2. royosherove commented on Oct 11, 2026

   

   royosherove

   on Oct 11, 2026

   Last edited by royosherove

   MemberAuthor

   More actions

   👻 Andromeda is on this · Kiro Crew Issue Radar
   awaiting-merge · PR #125 · updated 11:15 UTC

   The fix adds tokensMatch() to wake-lambda/index.mjs. It compares the UTF-8 byte lengths first and then calls crypto.timingSafeEqual, because timingSafeEqual throws when the lengths are not equal. Byte length is used, not string length, so a token with a multi-byte character cannot cause an exception. Wrong tokens still get 403. The new tests/test-wake-token.sh runs the real handler with stub AWS SDK modules: 4 of 5 checks pass on main (the source check fails), 5 of 5 pass after the fix on Node 22 and Node 26.

   progress

   • 11:11 claimed -- the token check is at wake-lambda/index.mjs line 55 on main (token !== stored). No other copy of the check exists. Open PR docs: wake-on-text architecture for idle-shutdown bootstrap #71 adds webhook.py and does not change index.mjs.

   • 11:13 opened PR fix(idle-shutdown): compare the wake token in constant time #125 -- constant-time compare plus a regression test that fails before the fix

   • 11:15 CI 20/20 green. Codex asks to start pack-tests on bootstraps/** changes; that is CI config, so it is left to a maintainer. The repo does not allow auto-merge, so the PR waits for a human merge
3. royosherove

   added

   crew: in progressIssue Radar work claimed by a Kiro Crew workerIssue Radar work claimed by a Kiro Crew worker

   on Oct 11, 2026