funman300/Ferrous-Solitaire
1
1
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 48 Wiki Activity

fix(server): login timing oracle — verify a dummy hash for unknown usernames #139

New Issue
Closed
opened 2026-07-07 03:06:04 +00:00 by funman300 · 0 comments
funman300 commented 2026-07-07 03:06:04 +00:00
Owner
Copy Link
Copy Source

Review finding L1 (2026-07-06). login (solitaire_server/src/auth.rs) returns InvalidCredentials immediately when the username doesn't exist, but pays a full bcrypt verify when it does — response timing distinguishes valid from invalid usernames (user enumeration). Fix: when the user row is missing, verify the supplied password against a static dummy bcrypt hash before returning 401, so both paths cost the same.

Principle: authentication failure paths should be indistinguishable — same status, same message, same time.

🤖 Generated with Claude Code

Review finding L1 (2026-07-06). `login` (solitaire_server/src/auth.rs) returns `InvalidCredentials` immediately when the username doesn't exist, but pays a full bcrypt verify when it does — response timing distinguishes valid from invalid usernames (user enumeration). Fix: when the user row is missing, verify the supplied password against a static dummy bcrypt hash before returning 401, so both paths cost the same. **Principle:** authentication failure paths should be indistinguishable — same status, same message, same *time*. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
android
bug
correctness
enhancement
performance
security
server
test
ui
ux
wasm
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
funman300 (Alex)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: funman300/Ferrous-Solitaire#139
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?