Timing Attack

generator-jhipster is vulnerable to a Timing Attack. The vulnerability exists because the _TokenProvider.java uses String.equals(str) to compare the given token-signature. This comparison method does not effectively validate the token because it stops as soon as it encounters the first character that differs. This behavior opens up a vulnerability that allows an attacker to guess tokens through brute-force attacks, attempting one character at a time and using timing observations to discern the correct character.