it seems this is hash_equals with the s at the end (#2108)

monkeyiq · web-flow · commit 033ffa412ab9 · 2024-05-27T10:06:05.000+02:00
diff --git a/src/SimpleSAML/Session.php b/src/SimpleSAML/Session.php
@@ -17,7 +17,7 @@
 use function call_user_func;
 use function defined;
 use function get_object_vars;
-use function hash_equal;
+use function hash_equals;
 use function header_register_callback;
 use function intval;
 use function is_a;
@@ -379,7 +379,7 @@ public static function getSession(string $sessionId = null): ?Session
                     Logger::warning('Missing AuthToken cookie.');
                     return null;
                 }
-                if (!hash_equal($session->authToken, $_COOKIE[$authTokenCookieName])) {
+                if (!hash_equals($session->authToken, $_COOKIE[$authTokenCookieName])) {
                     Logger::warning('Invalid AuthToken cookie.');
                     return null;
                 }
