mirror of
https://github.com/rclone/rclone.git
synced 2026-11-07 18:22:55 -05:00
Nick Craig-Wood
e3c400f583
When a username wasn't in the htpasswd file the request was rejected without checking the password at all, whereas a known username with a wrong password went through the (deliberately slow) bcrypt check, so the time taken let an unauthenticated client find out which usernames exist. The same was true of --user/--pass with MD5-crypt. Unknown usernames are now checked against a decoy hash of a random password made in the same format and with the same cost as the most expensive entry in the htpasswd file, remade whenever the file changes, and --user/--pass always hash the password. This affects serve http, serve webdav, serve restic, serve s3, rcd --rc-htpasswd and --metrics-htpasswd.