Use constant time comparisons for CSRF tokens

[rwinch]

While it is not a practical exploit at this point, it is best to be defensive. We should change CSRF token comparison to use a constant time comparison to avoid side channel attacks.

NOTE: This was originally reported via Xhelal Likaj, [email protected]

[ogarber]

Hi @rwinch , I have a question: will this fix also be merged in the older pipe-lines (I'm interesting in 5.2.x...).
Thank you in advance

[ogarber]

Hi @rwinch , sorry for annoying...
Did you see my previous comment?

[vnjapa]

Hi @rwinch, will this fix will be merged in older versions like 5.2.x or when can we expect this release

[rwinch]

I have backported the issue (see the linked issues). Each issue has a milestone with the expected release date.

[ogarber]

Thank you @rwinch !