How severe is timing attack in string comparison?

Shield rates this medium (CVSS 5.3), classified as CWE-208.

Rules / Python

SHIELD-PY-017

Timing attack in string comparison

mediumPythonCWE-208CVSS 5.3

Using == for secret comparison is vulnerable to timing attacks.

Use hmac.compare_digest() for constant-time string comparison of secrets.

Vulnerable — Shield flags thisauth.py

def verify_api_key(provided_key: str, stored_key: str) -> bool:
    if provided_key == stored_key:
        return True
    return False

Fixed — scans cleanauth.py

import hmac

def verify_api_key(provided_key: str, stored_key: str) -> bool:
    return hmac.compare_digest(provided_key, stored_key)

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PY-017, the fixed one does not.