diff --git a/oauth2client/xsrfutil.py b/oauth2client/xsrfutil.py
index 7d5fdbe..7e1fe5c 100644
--- a/oauth2client/xsrfutil.py
+++ b/oauth2client/xsrfutil.py
@@ -100,7 +100,14 @@
   # The given token should match the generated one with the same time.
   expected_token = generate_token(key, user_id, action_id=action_id,
                                   when=token_time)
-  if token != expected_token:
+  if len(token) != len(expected_token):
+    return False
+
+  # Perform constant time comparison to avoid timing attacks
+  different = 0
+  for x, y in zip(token, expected_token):
+    different |= ord(x) ^ ord(y)
+  if different:
     return False
 
   return True