fix(backend): migrate webhooks to use canonical timingsafekey comparison

Merged
LU
3mo ago
+9-14

fix: #1699

Replace two call sites of custom safeEqualString() with timingSafeKeyCompare() to match the canonical constant-time comparison used in other internal routes (serviceAnnounce.ts, internalNotify.ts, serviceGuild.ts). Removes now-unused safeEqualString function definition and its timingSafeEqual import.

Summary by cubic

Standardizes webhook auth to use timingSafeKeyCompare for constant-time key checks in Top.gg and internal notify endpoints, aligning with other internal routes and addressing #1699. Removes the custom safeEqualString helper and the timingSafeEqual import.

Summary by CodeRabbit

  • Bug Fixes
    • Improved webhook request verification for better protection against invalid or tampered requests.
    • Kept vote streak and duplicate-vote behavior unchanged while making the handling more reliable.