web_modules/forge.bundle.js
function compareMacs(key, mac1, mac2) {
  var hmac = forge.hmac.create();

  hmac.start('SHA1', key);
  hmac.update(mac1);
  mac1 = hmac.digest().getBytes();

  hmac.start(null, null);
  hmac.update(mac2);
  mac2 = hmac.digest().getBytes();

  return mac1 === mac2;
}
function compareMacs(key, mac1, mac2) {
  var hmac = forge.hmac.create();

  hmac.start('SHA1', key);
  hmac.update(mac1);
  mac1 = hmac.digest().getBytes();

  hmac.start(null, null);
  hmac.update(mac2);
  mac2 = hmac.digest().getBytes();

  return mac1 === mac2;
}
function compareMacs ( key , mac1 , mac2 ) { var hmac = forge . hmac . create ( ) ; hmac . start ( 'SHA1' , key ) ; hmac . update ( mac1 ) ; mac1 = hmac . digest ( ) . getBytes ( ) ; hmac . start ( null , null ) ; hmac . update ( mac2 ) ; mac2 = hmac . digest ( ) . getBytes ( ) ; return mac1 === mac2 ; }
Safely compare two MACs. This function will compare two MACs in a way
that protects against timing attacks.

TODO: Expose elsewhere as a utility API.

See: https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/february/double-hmac-verification/

@param key the MAC key to use.
@param mac1 as a binary-encoded string of bytes.
@param mac2 as a binary-encoded string of bytes.

@return true if the MACs are the same, false if not.
Safely compare two MACs . This function will compare two MACs in a way that protects against timing attacks .