.tip

a === b on two strings returns as soon as a byte differs, and the time it takes leaks how many leading bytes matched. Over enough requests that is the whole token.

import { timingSafeEqual } from "node:crypto";
const ok = a.length === b.length && timingSafeEqual(Buffer.from(a), Buffer.from(b));

Webhook signatures, API keys, password reset tokens. Anything where the caller controls one side of the comparison.