[SECURITY] Timing Attack Vulnerability in Authentication #20

New issue

Open

opened 2026-02-14 21:24:51 +00:00 by thabeta · 0 comments

thabeta commented

2026-02-14 21:24:51 +00:00

Owner

In src/server/auth.rs (Lines 64-68), the password comparison uses a standard string equality check:

if user_data.password != user.password { ... }

Risk: Standard string comparison (!=) returns as soon as a mismatch is found. This allows an attacker to perform a timing attack to guess the password character by character based on how long the server takes to respond.

Fix: Use a constant-time comparison (e.g., from the subtle crate) for all sensitive credential checks.

In `src/server/auth.rs` (Lines 64-68), the password comparison uses a standard string equality check: ```rust if user_data.password != user.password { ... } ``` **Risk:** Standard string comparison (`!=`) returns as soon as a mismatch is found. This allows an attacker to perform a timing attack to guess the password character by character based on how long the server takes to respond. **Fix:** Use a constant-time comparison (e.g., from the `subtle` crate) for all sensitive credential checks.