web: generate the basic auth decoy hash at the cost in use

[mrueg]

When a request names a user that is not configured, the handler compares the supplied password against a fixed hash so the request takes about as long as one naming a configured user. The comment says this is there "to prevent user enumeration by timing requests".

That hash is hardcoded at bcrypt cost 10, while the real users' hashes use whatever cost the operator chose. Whenever they chose a higher one, the mitigation does not hold.

Measured with users hashed at cost 14:

request	time
rejected, configured user	1.12 s
rejected, unknown user	70 ms

A 16× gap, trivially readable over a network. The repository's own fixtures use costs 12 and 18, and the docs recommend up to 18.

Change

Generate the decoy at the highest cost among the configured users, so the two paths cost the same. The highest is used rather than an average because a decoy cheaper than some configured user leaves that user enumerable. Where the configured costs differ the cheaper users are still answered faster than the decoy, so using one cost for every user remains the right thing to do — that is now called out in the docs.

Hashes are generated at most once per cost and cached for the lifetime of the process, since generating one is as expensive as comparing against it.

What this costs, stated plainly

This makes rejected requests as expensive as the most expensive configured user. That is the point — the two cases have to cost the same — but it does raise the cost of an unauthenticated request from a fixed ~70 ms to whatever the highest configured cost is. Measured here: 286 ms at cost 12, 1.1 s at cost 14, 18 s at cost 18.

A wrong password for a known username already cost that much before this change, so the exposure is not new; it just no longer requires knowing a username. The documentation now says so and points at rate_limit.

Fixture change

Both shared user fixtures carried a cost-18 entry for a user no test ever authenticates as. With the decoy tracking the highest cost, that entry alone added ~70 s to the suite. It is lowered to cost 14, which keeps the fixtures covering a spread of costs (10, 12, 14) at a fraction of the runtime. Suite time goes from 10.5 s on master to 14.7 s here.

Tests

Table test for maxBcryptCost including unparseable hashes, and tests that the decoy carries the requested cost and is generated once per cost.

🤖 Generated with Claude Code