Commit 1ede6eb0 authored by James Edwards-Jones's avatar James Edwards-Jones

TokenAuthenticatable provides comparison method

Avoids attempting save on comparison, as that could potentially reveal
that a resource exists.

Uses secure comparison incase this is reused somewhere sensitive.
parent d4f29787
......@@ -53,6 +53,11 @@ module TokenAuthenticatable
define_method("reset_#{token_field}!") do
strategy.reset_token!(self)
end
define_method("#{token_field}_matches?") do |other_token|
token = read_attribute(token_field)
token.present? && ActiveSupport::SecurityUtils.variable_size_secure_compare(other_token, token)
end
end
end
end
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment