[Mihir-Rabari]

🚨 Severity: MEDIUM
💡 Vulnerability: The internal service secret (X-Internal-Secret) in codexRoutes.ts was verified using a direct string comparison (!==). This allows an attacker to perform a timing attack by measuring the time it takes for the comparison to fail, potentially brute-forcing the secret byte by byte.
🎯 Impact: If the internal secret is compromised, an attacker could bypass internal security controls, potentially leading to unauthorized access to internal APIs such as fetching valid access tokens for arbitrary user IDs.
🔧 Fix: Replaced the standard string comparison with a constant-time comparison using crypto.timingSafeEqual. The input strings are first converted to Buffers, and their lengths are explicitly checked prior to comparison.
✅ Verification: Ran pnpm build && pnpm lint && pnpm test and explicitly cd apps/auth-service && pnpm test to verify that the authentication flows, including valid and invalid internal secret verifications, behave securely and without regressions.

---

PR created automatically by Jules for task 2423478977468451839 started by @Mihir-Rabari

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.