Repository navigation
Login and registration leak whether an account exists (response timing and 409) #1964
Description
Problem
AuthService.login returns immediately when the email is unknown, but runs a bcrypt comparison (cost 12, hundreds of milliseconds) when it is known, so response time reveals which emails are registered. register additionally answers 409 Email is already registered. Together with the weak per-account throttling this makes targeted credential stuffing easy.
Proposed change
Compare against a dummy bcrypt hash when the user is missing so both paths take comparable time, and decide whether registration should respond identically for existing emails (send a "you already have an account" email instead of a 409).
Acceptance criteria
- A timing test shows no significant difference between unknown and known emails with a wrong password (within a tolerance).
- Behaviour for registration is documented and tested.
Activity
Fayyo commentedon Oct 17, 2026
@Fayyo has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @Fayyo to this issue.
RennyThompson commentedon Oct 17, 2026
@RennyThompson has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @RennyThompson to this issue.
drips-wave commentedon Oct 17, 2026
Congratulations, @RennyThompson! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.
🧑💻 @RennyThompson: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
🌊 Happy Wave 🌊
fix(backend): close auth enumeration, unbounded ledger export, hand-r…
grantfox-oss commentedon Oct 17, 2026
🎉 This issue has been marked as completed on GrantFox!
@RennyThompson's PR #2046 was approved and merged by @yusuftomilola.
🏆 @RennyThompson: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (643 total points). Track your full progress on GrantFox.
👏 Great work, @RennyThompson! Keep contributing to DistinctCodes.
drips-wave commentedon Oct 17, 2026
This issue has been completed by @RennyThompson as part of the Stellar Wave Program's 10th Wave 🥳
😎 @RennyThompson: You earned 200 Points for completing this issue! Once the Wave's rewards are finalized, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.
🧑💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.