RockteMQ-AI commented on code in PR #4339:
URL:
https://github.com/apache/rocketmq-dashboard/pull/4339#discussion_r4016220839
##########
server/src/main/java/org/apache/rocketmq/studio/auth/AuthService.java:
##########
@@ -89,6 +89,12 @@ public class AuthService {
private final PasswordHasher passwordHasher;
private final LoginRateLimiter loginRateLimiter;
+ // A well-formed PBKDF2 hash of a random preimage that is not a real
credential.
+ // Disabled accounts verify against it so an attempt costs the same as a
+ // wrong-password attempt on an enabled account while their stored hash is
never used.
+ private static final String DUMMY_PASSWORD_HASH =
Review Comment:
**[Info]** The `DUMMY_PASSWORD_HASH` is a good approach for timing-attack
mitigation. One minor consideration: the hash is hardcoded as a constant, which
means all disabled account verifications use the same dummy hash. While this
doesn't weaken security (the preimage is unknown), rotating or randomizing the
dummy hash per-instance could make it slightly harder for an attacker to
identify the disabled-account path through hash analysis.
That said, this is a minor point — the current implementation is secure and
the 210,000 PBKDF2 iterations ensure the cost matches a real password check.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
