From ed4ce6b52e09e5285dfa9435a39a597d3c92ed80 Mon Sep 17 00:00:00 2001 From: Nicolas Pastorello Date: Thu, 16 Jul 2026 13:03:21 -0300 Subject: [PATCH] fix: use timing-safe compare for cron secret Match flows cron implementation (timingSafeEqual). --- src/app/api/automations/cron/route.ts | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/app/api/automations/cron/route.ts b/src/app/api/automations/cron/route.ts index 97c39ea..5424d90 100644 --- a/src/app/api/automations/cron/route.ts +++ b/src/app/api/automations/cron/route.ts @@ -1,3 +1,4 @@ +import { timingSafeEqual } from 'node:crypto' import { NextResponse } from 'next/server' import { supabaseAdmin } from '@/lib/automations/admin-client' import { resumePendingExecution } from '@/lib/automations/engine' @@ -19,8 +20,13 @@ export async function GET(request: Request) { if (!expected) { return NextResponse.json({ error: 'cron not configured' }, { status: 503 }) } - const supplied = request.headers.get('x-cron-secret') - if (supplied !== expected) { + const supplied = request.headers.get('x-cron-secret') ?? '' + const suppliedBuf = Buffer.from(supplied) + const expectedBuf = Buffer.from(expected) + if ( + suppliedBuf.length !== expectedBuf.length || + !timingSafeEqual(suppliedBuf, expectedBuf) + ) { return NextResponse.json({ error: 'Unauthorized' }, { status: 401 }) }