From bd9f3750942357c8383a145d0ae75cbc815006cb Mon Sep 17 00:00:00 2001
From: Bryan Frimin <bryan@getprobo.com>
Date: Mon, 23 Jun 2025 09:42:39 -0700
Subject: [PATCH] Mitigate timing attack on signin

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
---
 pkg/usrmgr/usrmgr.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkg/usrmgr/usrmgr.go b/pkg/usrmgr/usrmgr.go
index f88033549..989e7c65c 100644
--- a/pkg/usrmgr/usrmgr.go
+++ b/pkg/usrmgr/usrmgr.go
@@ -352,6 +352,8 @@ func (s Service) SignIn(
 		ctx,
 		func(tx pg.Conn) error {
 			if err := user.LoadByEmail(ctx, tx, email); err != nil {
+				_, _ = s.hp.ComparePasswordAndHash([]byte("this-compare-should-never-succeed"), []byte("it-just-to-prevent-timing-attack"))
+
 				var errUserNotFound *coredata.ErrUserNotFound
 
 				if errors.As(err, &errUserNotFound) {