equalizeLoginTiming function

Future<void> equalizeLoginTiming(
  1. Map<String, Object?> credentials
)

When no user matched credentials, hashes their password against a dummy hash so failed logins for unknown and known accounts take the same time (user enumeration mitigation, BLUEPRINT_V2 ยง9.2 item 9).

Implementation

Future<void> equalizeLoginTiming(Map<String, Object?> credentials) async {
  String? plain;
  for (final entry in credentials.entries) {
    final value = entry.value;
    if (entry.key.contains('password') && value is String) {
      plain = value;
      break;
    }
  }
  if (plain == null) {
    return;
  }
  final HashManager hasher;
  try {
    hasher = Container.current.make<HashManager>();
  } on Object {
    return; // No hashing configured (custom providers).
  }
  await hasher.checkAgainstDummy(plain);
}