Comparing UUIDs is cheap, but avoiding non-constant-time compares is a necessity. So the usual for loop with an early exit when two bytes don't match up is pois

Comparing UUIDs is cheap, but avoiding non-constant-time compares is a necessity. So the usual for loop with an early exit when two bytes don't match up is poison. A web application could become susceptible to timing attacks. This is a good article that helped me understand and mitigate the vulnerability: https://codahale.com/a-lesson-in-timing-attacks/ https://codahale.com/a-lesson-in-timing-attacks/