ID header check vulnerable to timing attack

[windoze95]

Summary

In internal/middleware/headers.go:13, CheckIDHeader compares the shared secret using != which is not constant-time:

if idHeaderValue != id {

This allows timing side-channel attacks to brute-force the secret value one character at a time by measuring response latency.

Suggested Fix

Use crypto/subtle.ConstantTimeCompare:

import "crypto/subtle"

if subtle.ConstantTimeCompare([]byte(idHeaderValue), []byte(id)) != 1 {

Comparison time will then be constant regardless of how many characters match.