Fix timing attack on signin

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/iam/auth_service.go

@@ -505,7 +505,7 @@ func (s AuthService) CheckCredentials(
 			// Perform a password comparison even when the identity does not exist to mitigate timing attacks
 			// and prevent revealing account existence.
 			if identity.ID == gid.Nil {
-				_, _ = s.hp.ComparePasswordAndHash([]byte(password+"qwertyuiop1234567890"), []byte("qwertyuiop1234567890"))
+				_, _ = s.hp.ComparePasswordAndHash([]byte(password), s.dummyHash)
 				return NewInvalidCredentialsError("invalid email or password")
 			}
 

pkg/iam/service.go

@@ -45,6 +45,7 @@ type (
 		pg                         *pg.Client
 		fm                         *filemanager.Service
 		hp                         *passwdhash.Profile
+		dummyHash                  []byte
 		baseURL                    string
 		tokenSecret                string
 		disableSignup              bool
@@ -99,6 +100,15 @@ type (
 	}
 )
 
+func mustHashDummy(hp *passwdhash.Profile) []byte {
+	h, err := hp.HashPassword([]byte("dummy"))
+	if err != nil {
+		panic(fmt.Sprintf("cannot hash dummy password: %v", err))
+	}
+
+	return h
+}
+
 func NewService(
 	ctx context.Context,
 	pgClient *pg.Client,
@@ -126,6 +136,7 @@ func NewService(
 		pg:                         pgClient,
 		fm:                         fm,
 		hp:                         hp,
+		dummyHash:                  mustHashDummy(hp),
 		baseURL:                    cfg.BaseURL.String(),
 		tokenSecret:                cfg.TokenSecret,
 		disableSignup:              cfg.DisableSignup,