fabi/Mangalord
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bugfix: equalise login response time across user-existence branches (0.34.1)

Browse Source 
A login attempt against a non-existent username returned 401 in <1ms,
while the wrong-password branch ran argon2 verify (~50-100ms). Timing
the difference let an attacker enumerate valid usernames without ever
seeing a successful response. Run verify_password against a fixed
dummy argon2id hash on the no-user branch so both paths spend the
same compute.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
MechaCat02
2026-05-28 07:46:46 +02:00
parent e7662d18d6
commit 4863219cf6
4 changed files with 113 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
backend/Cargo.toml
View File

@@ -1,6 +1,6 @@
[package]
name = "mangalord"
version = "0.34.0"
version = "0.34.1"
edition = "2021"
default-run = "mangalord"