fix: use timingSafeEqual for Instagram verify_token

[joycefoster642]

Description

Fixes #692

Replace direct string comparison with timingSafeEqual to prevent timing attacks on Instagram webhook verification.

Checklist

Before submitting your PR, please verify the following:

• I have run pnpm lint and all checks pass
• I have run pnpm typecheck and there are no TypeScript errors
• I have run pnpm build and all packages build successfully
• I have run pnpm test and all tests pass
• I have added or updated tests where applicable
• I have added or updated necessary documentation

Screenshots / Demos (if applicable)

Additional Notes

Summary by CodeRabbit

Security

• Improved webhook verification with timing-safe token comparison.
• Requests with missing, mismatched, or incorrectly sized tokens are rejected.
• Valid webhook verification continues to work as expected.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
www	Skipped		Aug 14, 2026 6:41pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5050d193-5e8f-49fd-b849-ca83c6e5bacb

📥 Commits

Reviewing files that changed from the base of the PR and between a4ce5df and 1eb3c94.

📒 Files selected for processing (1)

• packages/instagram/webhooks/challenge.test.ts

---

📝 Walkthrough

Walkthrough

Instagram webhook verification now uses length-checked timingSafeEqual comparison. Tests cover matching tokens, same-length mismatches, and length mismatches.

Changes

Instagram token verification

Layer / File(s)	Summary
Timing-safe token comparison and validation packages/instagram/webhooks/challenge.ts, packages/instagram/webhooks/challenge.test.ts	The challenge handler compares token buffers with timingSafeEqual and rejects missing or unequal-length tokens. Tests cover successful and invalid challenge responses.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 1eb3c

This localized security hardening changes Instagram webhook token comparison without any supplied merge-blocking risk; it is merge-ready after normal checks and review.

Possibly related issues

• corsairdev/corsair issue 704: Applies the same length-checked timingSafeEqual approach to webhook token verification for another platform.
• corsairdev/corsair issue 707: Applies length-checked constant-time comparison to Telegram webhook token validation.

Possibly related PRs

• corsairdev/corsair#605: Hardens webhook verification with constant-time, length-safe comparisons and matching or invalid-length tests.
• corsairdev/corsair#615: Updates webhook challenge validation and tests to use timingSafeEqual.
• corsairdev/corsair#732: Applies constant-time, length-checked token comparison to another webhook integration.

Suggested reviewers: yuvrxj-afk

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The implementation and tests satisfy issue #692 by using constant-time comparison and preserving success, failure, and missing-token behavior.
Out of Scope Changes check	✅ Passed	The changes are limited to Instagram webhook verification and its tests, which matches issue #692.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: using timingSafeEqual for Instagram webhook token verification.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR replaces direct Instagram webhook verification-token comparison with a byte-length check and timingSafeEqual.

• Converts the received and configured tokens to buffers.
• Rejects missing or unequal-length tokens before invoking the timing-safe comparison.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
packages/instagram/webhooks/challenge.ts	Safely introduces timing-resistant token comparison while retaining fail-closed handling for missing and mismatched tokens.

_{Reviews (2): Last reviewed commit: "fix(instagram): indent timingSafeEqual c..." | Re-trigger Greptile}

[Dhirenderchoudhary]

@joycefoster642 The timingSafeEqual change is right, but the new lines mix tabs and spaces (and there’s a trailing space on const a). That’ll fail format. Re-indent to match the rest of the file and this is good to go.

[Dhirenderchoudhary]

@greptile review

[joycefoster642]

Just noting that this appears to be fixed by commit a4ce5df. Happy to close this PR. Thanks to @Dhirenderchoudhary for the merge!

[ambikeesshh]

compare looks right. please add the tests from the inline note, then this should be good.

[Dhirenderchoudhary]

LGTM