Skip to content

Instantly share code, notes, and snippets.

@tadeaspetak

tadeaspetak/fullstack-security-auth-timing.ts

Created January 30, 2022 15:09
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save tadeaspetak/3712f6659c7116f6d137496ebfc25674 to your computer and use it in GitHub Desktop.
Save tadeaspetak/3712f6659c7116f6d137496ebfc25674 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
fullstack-security-auth-timing.ts
const user = Users.findByEmail(params.email);
if (!user || !Users.verifyPassword(params.password, user)) {
await new Promise((resolve) => setTimeout(resolve, crypto.randomInt(11, 111))); // mitigate timing attacks
return res.status(401).json({ message: "Invalid credentials." });
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment