rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Mitigate timing attack on signin

Browse Source 
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2025-06-23 09:42:39 -07:00
parent 07d943be86
commit bd9f375094
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/usrmgr/usrmgr.go
View File

@@ -352,6 +352,8 @@ func (s Service) SignIn(
ctx, ctx,
func(tx pg.Conn) error { func(tx pg.Conn) error {
if err := user.LoadByEmail(ctx, tx, email); err != nil { if err := user.LoadByEmail(ctx, tx, email); err != nil {
_, _ = s.hp.ComparePasswordAndHash([]byte("this-compare-should-never-succeed"), []byte("it-just-to-prevent-timing-attack"))
var errUserNotFound *coredata.ErrUserNotFound var errUserNotFound *coredata.ErrUserNotFound
if errors.As(err, &errUserNotFound) { if errors.As(err, &errUserNotFound) {