Matthew Holt 937ec34201

caddyauth: Prevent user enumeration by timing ...

Always follow the code path of hashing and comparing a plaintext
password even if the account is not found by the given username; this
ensures that similar CPU cycles are spent for both valid and invalid
usernames.

Thanks to @tylerlm for helping and looking into this!

2020-10-31 10:51:05 -06:00

..

basicauth.go

caddyauth: Prevent user enumeration by timing

2020-10-31 10:51:05 -06:00

caddyauth.go

httpcaddyfile: Don't lowercase placeholder contents (fixes #3264)

2020-04-14 16:11:46 -06:00

caddyfile.go

caddyhttp: Add client cert SAN placeholders

2020-06-11 16:19:07 -06:00

command.go

caddyauth: Prevent user enumeration by timing

2020-10-31 10:51:05 -06:00

hashes.go

caddyauth: Prevent user enumeration by timing

2020-10-31 10:51:05 -06:00