Harden HMAC authentication against timing and validation bypasses

[pwelter34]

Summary

This PR strengthens the HMAC authentication implementation with critical security hardening across three areas: timing side-channel resistance, CIDR validation bounds checking, and mandatory signed header enforcement.

Key Changes

1. Timing Side-Channel Protection in FixedTimeEquals

• Before: Length mismatches caused early returns, leaking information about input lengths via timing
• After: Constant-time comparison that does not reveal length differences
  • On .NET Standard 2.0: XOR lengths into result accumulator before comparison loop
  • On .NET 6+: Guard length check with dummy comparison to maintain constant-time behavior
• Prevents attackers from using timing analysis to infer signature or hash lengths

2. CIDR Prefix Length Validation in IpAddressWhitelist

• Before: Invalid prefix lengths (negative or exceeding address family limits) were not validated, potentially matching all IPs
• After: Explicit bounds checking ensures prefix length is within valid range
  • IPv4: 0-32 bits
  • IPv6: 0-128 bits
  • Returns false for out-of-range values
• Prevents misconfiguration from accidentally whitelisting unintended IP ranges

3. Mandatory Signed Header Enforcement in HmacAuthenticationHandler

• Before: Clients could omit critical headers (x-timestamp, x-content-sha256) from SignedHeaders, weakening security
• After: New ValidateRequiredSignedHeaders() method enforces both headers are always included
  • Prevents replay attacks by ensuring timestamp is cryptographically bound
  • Prevents body substitution by ensuring content hash is cryptographically bound
  • Returns MissingRequiredSignedHeaders failure if validation fails

4. Content-Length Bypass Prevention

• Before: Trusted Content-Length: 0 header to skip body hashing
• After: Only skips hashing for Stream.Null (no body stream at all)
• Prevents malicious clients/proxies from sending Content-Length: 0 with actual body content, causing hash mismatch

Implementation Details

• All changes maintain backward compatibility for legitimate clients
• Added comprehensive security-focused test suite (SecurityTests.cs) covering:
  • Timing side-channel scenarios
  • CIDR validation edge cases
  • Signed header enforcement
• Uses logging to track security validation failures for monitoring

https://claude.ai/code/session_0188rXmpYc7jnR1xnXV2BVBQ