Merge pull request #542 from snyff/patch-2

Update md5.rb
rack · Apr 17, 2013 · a04035d · a04035d
2 parents bba55fc + 9a953b1
commit a04035d
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/rack/auth/digest/md5.rb b/lib/rack/auth/digest/md5.rb
@@ -96,7 +96,7 @@ def valid_nonce?(auth)
 
         def valid_digest?(auth)
           pw = @authenticator.call(auth.username)
-          pw && digest(auth, pw) == auth.response
+          pw && Rack::Utils.secure_compare(digest(auth, pw), auth.response)
         end
 
         def md5(data)