summaryrefslogtreecommitdiff
path: root/modules/caddyhttp/push
diff options
context:
space:
mode:
authorMatthew Holt <mholt@users.noreply.github.com>2020-10-31 10:51:05 -0600
committerMatthew Holt <mholt@users.noreply.github.com>2020-10-31 10:51:05 -0600
commit937ec342010894f7a6239883b10f6a107ff82c9f (patch)
treee3dc861f6ac4e2675091b5c5b95d2ad3ffb96acb /modules/caddyhttp/push
parent966d5e6b42fc6da3da8bd39dd6ceceb8f1da3999 (diff)
caddyauth: Prevent user enumeration by timing
Always follow the code path of hashing and comparing a plaintext password even if the account is not found by the given username; this ensures that similar CPU cycles are spent for both valid and invalid usernames. Thanks to @tylerlm for helping and looking into this!
Diffstat (limited to 'modules/caddyhttp/push')
0 files changed, 0 insertions, 0 deletions