supabase / supavisor / 36875458827

81%

Build Type

push

github

Committed by web-flow

Commit Message

fix: support custom SCRAM iteration counts up to 32768 (#1222)

The server-first message always announced 4096 iterations, so clients of
users whose secret has another count computed a proof that never
matched, and failed with a wrong password error.

This adds support for custom iteration counts. Secrets above 32768
iterations are rejected, as cleartext password authentication derives
the key on our side, on every attempt with a wrong password (higher CPU
usage).

Coverage Stats

7 of 7 new or added lines in 3 files covered. (100.0%)

35 existing lines in 2 files now uncovered.

3066 of 3790 relevant lines covered (80.9%)

49591.85 hits per line