diff options
author | Matthew Holt <mholt@users.noreply.github.com> | 2020-10-31 10:51:05 -0600 |
---|---|---|
committer | Matthew Holt <mholt@users.noreply.github.com> | 2020-10-31 10:51:05 -0600 |
commit | 937ec342010894f7a6239883b10f6a107ff82c9f (patch) | |
tree | e3dc861f6ac4e2675091b5c5b95d2ad3ffb96acb /caddyconfig/configadapters.go | |
parent | 966d5e6b42fc6da3da8bd39dd6ceceb8f1da3999 (diff) |
caddyauth: Prevent user enumeration by timing
Always follow the code path of hashing and comparing a plaintext
password even if the account is not found by the given username; this
ensures that similar CPU cycles are spent for both valid and invalid
usernames.
Thanks to @tylerlm for helping and looking into this!
Diffstat (limited to 'caddyconfig/configadapters.go')
0 files changed, 0 insertions, 0 deletions