fix(account): use constant time comparison for password check

api/account/login.go

@@ -18,8 +18,8 @@
 package account
 
 import (
-	"bytes"
 	"crypto/rand"
+	"crypto/subtle"
 	"database/sql"
 	"encoding/base64"
 	"errors"
@@ -51,7 +51,7 @@ func Login(username, password string) (LoginResponse, error) {
 		return response, err
 	}
 
-	if !bytes.Equal(key, deriveArgon2IDKey([]byte(password), salt)) {
+	if subtle.ConstantTimeCompare(key, deriveArgon2IDKey([]byte(password), salt)) == 0 {
 		return response, fmt.Errorf("password doesn't match")
 	}