Verify without exposing: Constant-time authentication with valid()

Retrieving a secret into application memory just to check equality with user input is a security anti-pattern. wauth's valid() verifies tokens in constant time without ever exposing the plain text.

Here is the exact production implementation for valid() Constant-Time Verification Protocol:

from wauth import WAuth

auth = WAuth()
# Setup: auth.set("ADMIN_TOKEN", "7483920:ABC-DEF-GHI")

user_submitted_token = "7483920:ABC-DEF-GHI"

# LESS SECURE: Calling get() leaks secret to memory and logs
# actual = auth.get("ADMIN_TOKEN")
# if actual == user_submitted_token: ...

# MORE SECURE: valid() compares in constant-time; secret never leaves wauth!
if auth.valid("ADMIN_TOKEN", user_submitted_token):
    print("Access granted: Token valid.")
else:
    print("Access denied: Invalid credentials.")

Why this changes developer velocity:

• Zero Secret Exposure: auth.valid('KEY', input) checks equality without exposing the secret to caller code.
• Constant-Time Comparison: Uses hmac.compare_digest under the hood to neutralize timing attacks.
• Boolean Result Only: Returns strictly True or False; the secret never escapes the cryptocore.

Zero Pain:

• Developers calling get('SECRET') and doing if secret == user_input:, leaking secrets to logs and memory dumps
• Timing side-channel attacks allowing adversaries to reconstruct secrets character by character
• Secrets lingering in garbage collection heaps where debuggers and memory inspection tools can read them

Explore the verified open-source repository on GitHub or install it via:

pip install wauth

Author: William Steve Rodríguez Villamizar (Wisrovi)