fix: prevent user enumeration using local login timings

requarks · Sep 17, 2022 · 4b30050 · 4b30050
1 parent 665284b
commit 4b30050
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/server/modules/authentication/local/authentication.js b/server/modules/authentication/local/authentication.js
@@ -1,3 +1,5 @@
+const bcrypt = require('bcryptjs-then')
+
 /* global WIKI */
 
 // ------------------------------------
@@ -28,6 +30,9 @@ module.exports = {
               done(null, user)
             }
           } else {
+            // Fake verify password to mask timing differences
+            await bcrypt.compare((Math.random() + 1).toString(36), '$2a$12$irXbAcQSY59pcQQfNQpY8uyhfSw48nzDikAmr60drI501nR.PuBx2')
+
             done(new WIKI.Error.AuthLoginFailed(), null)
           }
         } catch (err) {