Module: RubyLLM::MCP::Auth::Security

Defined in:
lib/ruby_llm/mcp/auth/security.rb

Overview

Security utilities for OAuth implementation

Class Method Summary collapse

Class Method Details

.constant_time_compare?(first, second) ⇒ Boolean

Constant-time comparison implementation

Parameters:

  • a (String) —

    first string

  • b (String) —

    second string

Returns:

  • (Boolean) —

    true if strings are equal



31
32
33
34
35
36
37
38
39
40
 
# File 'lib/ruby_llm/mcp/auth/security.rb', line 31

def constant_time_compare?(first, second)
  return false unless first.bytesize == second.bytesize

  l = first.unpack("C*")
  r = 0
  i = -1

  second.each_byte { |v| r |= v ^ l[i += 1] }
  r.zero?
end

.secure_compare(first, second) ⇒ Boolean

Constant-time string comparison to prevent timing attacks

Parameters:

  • a (String) —

    first string

  • b (String) —

    second string

Returns:

  • (Boolean) —

    true if strings are equal



14
15
16
17
18
19
20
21
22
23
24
25
 
# File 'lib/ruby_llm/mcp/auth/security.rb', line 14

def secure_compare(first, second)
  # Handle nil values
  return false if first.nil? || second.nil?

  # Use Rails/ActiveSupport's secure_compare if available (more battle-tested)
  if defined?(ActiveSupport::SecurityUtils) && ActiveSupport::SecurityUtils.respond_to?(:secure_compare)
    return ActiveSupport::SecurityUtils.secure_compare(first, second)
  end

  # Fallback to our own implementation
  constant_time_compare?(first, second)
end