ValidateUserPassword validates username/password without leaking user existence via credential-compare timing differences.
(users map[string]string, username, password string)
| 53 | // ValidateUserPassword validates username/password without leaking user existence |
| 54 | // via credential-compare timing differences. |
| 55 | func ValidateUserPassword(users map[string]string, username, password string) bool { |
| 56 | expectedPassword, userFound := users[username] |
| 57 | if !userFound { |
| 58 | expectedPassword = invalidPasswordSentinel |
| 59 | } |
| 60 | |
| 61 | passwordMatches := constantTimeStringEqual(password, expectedPassword) |
| 62 | return userFound && passwordMatches |
| 63 | } |
| 64 | |
| 65 | func constantTimeStringEqual(a, b string) bool { |
| 66 | ab := []byte(a) |