fix: prevent user enumeration using local login timings

4b300505 · NGPixel · 665284bf · 4b300505
Unverified Commit 4b300505 authored Sep 17, 2022 by NGPixel
Hide whitespace changes
Inline Side-by-side

Showing with 5 additions and 0 deletions

authentication.js server/modules/authentication/local/authentication.js +5 -0

No files found.
--- a/server/modules/authentication/local/authentication.js
+++ b/server/modules/authentication/local/authentication.js
+const bcrypt = require('bcryptjs-then')
+
 /* global WIKI */

 // ------------------------------------
@@ -28,6 +30,9 @@ module.exports = {
              done(null, user)
            }
          } else {
+            // Fake verify password to mask timing differences
+            await bcrypt.compare((Math.random() + 1).toString(36), '$2a$12$irXbAcQSY59pcQQfNQpY8uyhfSw48nzDikAmr60drI501nR.PuBx2')
+
            done(new WIKI.Error.AuthLoginFailed(), null)
          }
        } catch (err) {