Constant time comparison (#33588) (#33822)

Automatic Merge

server/channels/app/session.go

@@ -53,7 +53,7 @@ func (a *App) CreateSession(c request.CTX, session *model.Session) (*model.Sessi
 
 func (a *App) GetCloudSession(token string) (*model.Session, *model.AppError) {
 	apiKey := os.Getenv("MM_CLOUD_API_KEY")
-	if apiKey != "" && apiKey == token {
+	if apiKey != "" && subtle.ConstantTimeCompare([]byte(apiKey), []byte(token)) == 1 {
 		// Need a bare-bones session object for later checks
 		session := &model.Session{
 			Token:   token,