Is devise's token_authenticatable secure?

token_authenticatable is vulnerable to timing attacks, which are very well explained in this blog post. These attacks were the reason token_authenticatable was removed from Devise 3.1. See the plataformatec blog post for more info. To have the most secure token authentication mechanism, the token: Must be sent via HTTPS. Must be random, of cryptographic strength. Must be securely compared. Must no