even better security

Overlord-Server/src/server/agent-auth.ts

@@ -1,4 +1,12 @@
 import { logger } from "../logger";
+import { timingSafeEqual } from "crypto";
+
+function safeCompare(a: string, b: string): boolean {
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) return false;
+  return timingSafeEqual(bufA, bufB);
+}
 
 export function isAuthorizedAgentRequest(
   req: Request,
@@ -21,7 +29,9 @@ export function isAuthorizedAgentRequest(
 
   const headerToken = req.headers.get("x-agent-token");
   const queryToken = url.searchParams.get("token");
-  const isAuthed = headerToken === token || queryToken === token;
+  const isAuthed =
+    (headerToken !== null && safeCompare(headerToken, token)) ||
+    (queryToken !== null && safeCompare(queryToken, token));
 
   if (!isAuthed) {
     logger.info("[auth] Agent auth failed");

Overlord-Server/src/server/http-security.ts

@@ -1,5 +1,5 @@
 export const CORS_HEADERS = {
-  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Origin": "null",
   "Access-Control-Allow-Methods": "GET,OPTIONS",
   "Access-Control-Allow-Headers": "Content-Type",
 };
@@ -10,4 +10,6 @@ export const SECURITY_HEADERS = {
   "X-Frame-Options": "DENY",
   "X-XSS-Protection": "1; mode=block",
   "Referrer-Policy": "strict-origin-when-cross-origin",
+  "Strict-Transport-Security": "max-age=63072000; includeSubDomains",
+  "Permissions-Policy": "camera=(), geolocation=(), payment=()",
 };