diff options
| author | Matthew Holt <mholt@users.noreply.github.com> | 2020-10-31 10:51:05 -0600 |
|---|---|---|
| committer | Matthew Holt <mholt@users.noreply.github.com> | 2020-10-31 10:51:05 -0600 |
| commit | 937ec342010894f7a6239883b10f6a107ff82c9f (patch) | |
| tree | e3dc861f6ac4e2675091b5c5b95d2ad3ffb96acb /modules/caddyhttp/reverseproxy | |
| parent | 966d5e6b42fc6da3da8bd39dd6ceceb8f1da3999 (diff) | |
caddyauth: Prevent user enumeration by timing
Always follow the code path of hashing and comparing a plaintext
password even if the account is not found by the given username; this
ensures that similar CPU cycles are spent for both valid and invalid
usernames.
Thanks to @tylerlm for helping and looking into this!
Diffstat (limited to 'modules/caddyhttp/reverseproxy')
0 files changed, 0 insertions, 0 deletions