DeepFrontend
Learning Paths
Practice
System Design & DS
Design Studio
Data Structures Curriculum
Real-World Case Studies
Careers
Job Board
Resume Builder
Blog
Sign in
Search
⌘K
Go Pro
Loading compiler resources...
Web Security Quiz Practice
Active Recall Drill Session
← Exit Session
Question 1 of 1
hard
Web Security
Why use crypto.timingSafeEqual instead of === when comparing a submitted CSRF token to the expected value?
A
=== doesn't work on strings in JavaScript
B
A naive === comparison can leak timing information about how many leading characters matched, a minor side-channel that a constant-time comparison avoids
C
timingSafeEqual is required by the HTTP spec
D
There is no real difference
Check Answer