TikTok V5 + Security

src/lib/csrf.ts

@@ -1,5 +1,6 @@
 import { cookies } from 'next/headers';
 import { v4 as uuidv4 } from 'uuid';
+import crypto from 'crypto';
 import { getCsrfCookieOptions } from './cookieConfig';
 
 const CSRF_TOKEN_COOKIE = 'csrf_token';
@@ -38,7 +39,12 @@ export function validateCsrfToken(headerToken: string | null): boolean {
   }
 
   // Constant-time comparison to prevent timing attacks
-  return cookieToken === headerToken;
+  const cookieBuf = Buffer.from(cookieToken);
+  const headerBuf = Buffer.from(headerToken);
+  if (cookieBuf.length !== headerBuf.length) {
+    return false;
+  }
+  return crypto.timingSafeEqual(cookieBuf, headerBuf);
 }
 
 /**