- Shipped
- September 23, 2026 at 10:03 AM UTC
- Author
- Kamo
- Commit
- c48ed12
**************** used String.equals against X-Internal-Auth (a timing side channel on a shared secret) and, when esig.internal-auth-secret was unset, logged a warning and let the call through with NO verification at all — every X-Org-Id anyone sent was trusted. Now uses MessageDigest.isEqual (matching SignerSessionService's existing OTP comparison in this same repo) and refuses every call when the secret is unset, rather than falling through. Confirmed this is safe for production: k8s/configmap.yaml binds esig.internal-auth-secret to **************** and kubectl shows the *** secret is present and non-empty in the kamo namespace, and the deployed esigservice tag already carries this code path. New test: EsignInternalControllerTest (blank/null secret refused, wrong secret refused, right secret accepted).