CVE-2025-59425: Authorization Header Timing Attackcve-2025-59425-authorization-header-timing-attack
Comparing an authentication token (like the Authorization header) using standard equality operators (`in`, `not in`, `==`, `!=`) can lead to a timing side-channel. These operators short-circuit and leak the length of the matching prefix, allowing an attacker to guess the token character by character. Use `secrets.compare_digest` or `hmac.compare_digest` inst
