feat: add timing safe equal comparison

* chore: add [email protected] as dependency
* feat: add timing safe equal comparison

Co-authored-by: Blake Embrey <[email protected]>

Author: UlisesGascon

index.js

@@ -1,3 +1,4 @@
+var timingSafeCompare = require('tsscmp');
 var http = require('http');
 
 /*!
@@ -53,7 +54,9 @@ module.exports = function basicAuth(callback, realm) {
     if ('string' != typeof password) throw new Error('password argument required');
     realm = arguments[2];
     callback = function(user, pass){
-      return user == username && pass == password;
+      const usernameValid = timingSafeCompare(user, username);
+      const passwordValid = timingSafeCompare(pass, password);
+      return usernameValid && passwordValid;
     }
   }
 

package.json

@@ -18,12 +18,15 @@
     "url": "https://github.com/expressjs/basic-auth-connect/issues"
   },
   "devDependencies": {
+    "connect": "*",
     "mocha": "*",
     "should": "*",
-    "supertest": "*",
-    "connect": "*"
+    "supertest": "*"
   },
   "scripts": {
     "test": "make test"
+  },
+  "dependencies": {
+    "tsscmp": "^1.0.6"
   }
 }