How to use rails secure_compare?

ruby-on-rails, security

Solution

`secure_compare` is a public class method of ActiveSupport::SecurityUtils since rails 4.2.0 https://api.rubyonrails.org/classes/ActiveSupport/SecurityUtils.html#method-c-secure_compare

Usage example:

def authenticate_by_token
  authenticate_with_http_token do |token, options|
    user = User.find_by(id: options[:uid])
    if user && ActiveSupport::SecurityUtils.secure_compare(user.auth_token, token)
      @current_user = user
    end
  end
end

Problem

I have tried ``` line:60 mv = ActiveSupport::MessageVerifier.new return nil unless mv.secure_compare(a, b) ``` which gives the error ``` ArgumentError - wrong number of arguments (0 for 1..2): activesupport (4.0.3) lib/active_support/message_verifier.rb:29:in `initialize' app/controllers/application_controller.rb:60:in `new' ``` http://apidock.com/rails/ActiveSupport/MessageVerifier/secure_compare Edit The active support method was private so I just copied the method directly into application controller. ``` def secure_compare(a, b) return false unless a.bytesize == b.bytesize l = a.unpack "C#{a.bytesize}" res = 0 b.each_byte { |byte| res |= byte ^ l.shift } res == 0 end ``` Is there any blatant security concern with doing this or using this implementation?

Original source