mirror of
https://github.com/sigoden/dufs.git
synced 2026-04-08 16:49:02 +03:00
[GH-ISSUE #228] Is authentication done in constant time for Basic Authentication ? #117
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @perrinjerome on GitHub (Jun 2, 2023).
Original GitHub issue: https://github.com/sigoden/dufs/issues/228
Problem
If I understand correctly, when running with
--auth-method basic, this4f3a8d275b/src/auth.rs (L309-L315)is not comparing the password using constant time, which is not recommended according to
https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#compare-password-hashes-using-safe-functions
Maybe something like https://docs.rs/constant_time_eq/latest/constant_time_eq/ could be used instead, but I don't know much about rust ecosystem so I am can not really recommend any implementation.
Log
If applicable, add logs to help explain your problem.
Environment:
@sigoden commented on GitHub (Jun 2, 2023):
This is over optimized