Description

FastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detection

Impact

Timing side-channel vulnerability in verify_key(). The method applied a random delay only on verification failures, allowing an attacker to statistically distinguish valid from invalid API keys by measuring response latencies. With enough repeated requests, an adversary could infer whether a key_id corresponds to a valid key, potentially accelerating brute-force or enumeration attacks.

Affected: all users relying on verify_key() for API key authentication prior to the fix.

Patches

Yes. Users should upgrade to version 1.1.0 (or the version containing this fix). The patch applies a uniform random delay (min_delay to max_delay) to all responses regardless of outcome, eliminating the timing correlation.

Workarounds

Add an application-level fixed delay or random jitter to all authentication responses (success and failure) before the fix is applied.

Use rate limiting to reduce the feasibility of statistical timing attacks.

References

CWE-208: Observable Timing Discrepancy

Commit: 87b27640f77c5ef86c46311b6b5a7e2887e35b77

OWASP: https://owasp.org/www-community/attacks/Timing_attack

Mitigation

Aliases

References