mattupstate / flask-security / 874

28%

push

travis-ci

Fix timing attack on login form

As detailed in #357 the time it takes to process a login request is
considerably less if the user specified doesn't exist than if the
password is incorrect. This can be used as a user enumeration attack,
even if the login error messages were customized to avoid this.

I fixed it by increasing the response time of a non-existing user
request by hashing the given password anyway (if using good
password hashing algorithm this is what takes a relatively
large amount of time and makes the attack possibly).

closes #357

3 of 3 new or added lines in 1 file covered. (100.0%)

1360 of 1448 relevant lines covered (93.92%)

5.63 hits per line