fix: prevent user enumeration using local login timings

2022-09-17 17:36:40 -04:00 · 2022-09-17 17:36:40 -04:00 · 4b3005057f
commit 4b3005057f
parent 665284bf90
1 changed files with 5 additions and 0 deletions
--- a/server/modules/authentication/local/authentication.js
+++ b/server/modules/authentication/local/authentication.js
@ -1,3 +1,5 @@
+const bcrypt = require('bcryptjs-then')
+
 /* global WIKI */

 // ------------------------------------
@ -28,6 +30,9 @@ module.exports = {
              done(null, user)
            }
          } else {
+            // Fake verify password to mask timing differences
+            await bcrypt.compare((Math.random() + 1).toString(36), '$2a$12$irXbAcQSY59pcQQfNQpY8uyhfSw48nzDikAmr60drI501nR.PuBx2')
+
            done(new WIKI.Error.AuthLoginFailed(), null)
          }
        } catch (err) {