Answer
Use constant-time comparison functions like hash_equals() to prevent timing-based information leaks.
Quick Answer
Timing attacks measure response time differences to leak information. hash_equals() does constant-time comparison for tokens and HMACs. password_verify() is timing-safe. Avoid early-return string comparisons for secrets. Add consistent delay with usleep() when returning auth errors. Use HMAC (hash_hmac) for token validation instead of simple string equality checks.
S
SugharaIQ Editorial Team
Verified Answer
This answer has been peer-reviewed by industry experts holding senior engineering roles to ensure technical accuracy and relevance for modern interview standards.
Want to bookmark, take notes, or join discussions?
Sign in to access all features and personalize your learning experience.
Source: SugharaIQ