Suggestion: Don't use == comparison for authentication in sample code

[dideler]

In the User Manual, the sample code for verifying the Mailgun authentication signature uses ==.

E.g. e306a37#diff-229131ed0af7cf80ed3a9470ec7beb4cR701

But == comparisons are vulnerable to timing attacks.
Is it worth mentioning to use a constant time comparison?

In Ruby, there's a secure_compare method provided by Rack and Rails.

# Rack
Rack::Utils.secure_compare(a, b)

# Rails
ActiveSupport::SecurityUtils.secure_compare(a, b)

In Python, there's a compare_digest function in the standard library.

import hmac
hmac.compare_digest(a, b)

Both languages also have 3rd party libraries if the reader doesn't want to use any of the above methods.

[pirogoeth]

Hi, I'm working on a collection of these in #217 :)

[cogr4q]

Do we have anything in Java to compare the digest?

[rob-spoor]

@cogr4q : MessageDigest.isEqual