MCP Server Template for Cloudflare Workers

/** * Cryptographic utilities * * Contains timing-safe comparison for token validation. */ /** * Constant-time string comparison to prevent timing attacks. * * Standard === comparison can leak information about which character * differs based on timing. This function always takes the same amount * of time regardless of where strings differ. * * Use this for comparing secrets like AUTH_TOKEN. */ export function timingSafeEqual(a: string, b: string): boolean { // Still need to do work even if lengths differ to avoid length-based timing if (a.length !== b.length) { let result = 0; const maxLen = Math.max(a.length, b.length); for (let i = 0; i < maxLen; i++) { result |= (a.charCodeAt(i % a.length) || 0) ^ (b.charCodeAt(i % b.length) || 0); } return false; } let result = 0; for (let i = 0; i < a.length; i++) { result |= a.charCodeAt(i) ^ b.charCodeAt(i); } return result === 0; }