Create SafeComparisonOfHeaderValue.py

python/ql/src/experimental/Security/CWE-208/TimingAttackAgainstHeaderValue/SafeComparisonOfHeaderValue.py

@@ -0,0 +1,20 @@
+#!/usr/bin/env python
+# -*- coding: UTF-8 -*-
+
+"""
+@Desc   ：preventing timing attack against header value
+"""
+
+from flask import Flask
+from flask import request
+
+@app.route('/good1')
+def good1():
+    Secret = request.headers.get('X-Auth-Token')    
+    if not hmac.compare_digest("secret", "token"):
+        raise Exception('bad token')
+    return 'good'
+
+if __name__ == '__main__':
+    app.debug = True
+    app.run()