Loose type comparison (ARCH3138)

Key typescript.security.loose-type-comparison · Severity warning · Category security · CWE CWE-697

Using type-coercing loose equality (==) on security-sensitive values such as tokens, hashes, or passwords can enable authentication bypass through type juggling. Always use strict equality.

Incorrect

function verifyToken(provided: string, expected: string) {
  return provided == expected;
}

Correct

import { timingSafeEqual } from "crypto";

function verifyToken(provided: string, expected: string) {
  const a = Buffer.from(provided);
  const b = Buffer.from(expected);
  return a.length === b.length && timingSafeEqual(a, b);
}

Fix

Use strict === instead of loose ==; prefer timing-safe timingSafeEqual for secret comparisons.