FIG 01 · comment on api/sessions.go:212
func (s *Store) Valid(id, token string) bool { rec, ok := s.byID[id] return ok && rec.Token == token}== on a secret returns early on the first wrong byte, which leaks timing. Compare in constant time.
return ok && rec.Token == token return ok && subtle.ConstantTimeCompare([]byte(rec.Token), []byte(token)) == 1Comments where the code is. Not a summary pasted under the PR.
Relay comments on the exact line, explains the reason in a sentence or two, and offers a suggested change you can commit from the thread. It stays quiet on code it has nothing useful to say about.
- Suggested changes, one click to commit
- Reads callers and tests, not only the diff
- Nits off by default
- Replies when you push back