diff --git a/finance/app/auth.py b/finance/app/auth.py
index 0373645..098c4b3 100644
--- a/finance/app/auth.py
+++ b/finance/app/auth.py
@@ -46,7 +46,7 @@ def session_valid(token: str | None) -> bool:
 def require_auth(request: Request) -> None:
     settings = get_settings()
     header = request.headers.get("authorization", "")
-    if settings.api_key and header == f"Bearer {settings.api_key}":
+    if settings.api_key and hmac.compare_digest(header, f"Bearer {settings.api_key}"):
         return
     if session_valid(request.cookies.get(COOKIE)):
         return
diff --git a/finance/tests/test_auth.py b/finance/tests/test_auth.py
index eedfcd7..875f112 100644
--- a/finance/tests/test_auth.py
+++ b/finance/tests/test_auth.py
@@ -12,3 +12,19 @@ def test_login_flow(client):
                     follow_redirects=False)
     assert r.status_code == 303
     assert client.get("/api/accounts").status_code == 200  # Cookie reicht
+
+
+def test_logout_flow(client):
+    r = client.post("/login", data={"username": "admin", "password": "geheim"},
+                    follow_redirects=False)
+    assert r.status_code == 303
+    assert client.get("/api/accounts").status_code == 200
+
+    r = client.post("/logout", follow_redirects=False)
+    assert r.status_code == 303
+    assert client.get("/api/accounts").status_code == 401
+
+
+def test_tampered_session_cookie_rejected(client):
+    client.cookies.set("fb_session", "gui.invalid-signature")
+    assert client.get("/api/accounts").status_code == 401