ideal-auth 1.3.1 → 1.3.3

package/README.md

@@ -163,6 +163,8 @@ const session = auth();
 await session.attempt({ email, password }); // password verified internally
 ```
 
+> **Timing note:** `attempt()` runs `hash.verify()` against a cached dummy hash when the user is not found, so the user-exists and user-missing paths take roughly the same time. For full protection against user enumeration, ensure your `resolveUserByCredentials` lookup is not catastrophically slower for non-existent users (e.g. use an indexed column).
+
 **Manual (escape hatch):** Provide `attemptUser` for full control over lookup and verification. Takes precedence over the Laravel-style config if both are provided.
 
 ```typescript

package/dist/auth-instance.js

@@ -1,5 +1,17 @@
 import { seal, unseal } from './session/seal';
 import { buildCookieOptions } from './session/cookie';
+// Equalize attempt() timing between user-found and user-missing paths by always
+// running hash.verify(). The dummy hash is cached per HashInstance so repeated
+// misses match the cost of a real verify.
+const dummyHashCache = new WeakMap();
+function getDummyHash(hash) {
+    let p = dummyHashCache.get(hash);
+    if (!p) {
+        p = hash.make('__ideal-auth-dummy__');
+        dummyHashCache.set(hash, p);
+    }
+    return p;
+}
 export function createAuthInstance(deps) {
     let cachedPayload;
     let cachedUser;
@@ -10,7 +22,11 @@ export function createAuthInstance(deps) {
         }
     }
     async function readSession() {
-        validateSecret();
+        // Fail closed on reads — no secret means no session, not an error
+        if (!deps.secret || deps.secret.length < 32) {
+            cachedPayload = null;
+            return null;
+        }
         if (cachedPayload !== undefined)
             return cachedPayload;
         const raw = await deps.cookie.get(deps.cookieName);
@@ -108,12 +124,14 @@ export function createAuthInstance(deps) {
             if (deps.hash && deps.resolveUserByCredentials) {
                 const { [deps.credentialKey]: password, ...lookup } = credentials;
                 const dbUser = await deps.resolveUserByCredentials(lookup);
-                if (!dbUser)
-                    return false;
-                const storedHash = dbUser[deps.passwordField];
-                if (!storedHash || !(await deps.hash.verify(password, storedHash))) {
+                // Run verify even on miss against a dummy hash — prevents user enumeration via timing
+                const storedHash = dbUser
+                    ? dbUser[deps.passwordField]
+                    : undefined;
+                const hashToCheck = storedHash ?? (await getDummyHash(deps.hash));
+                const ok = await deps.hash.verify(password, hashToCheck);
+                if (!dbUser || !storedHash || !ok)
                     return false;
-                }
                 await writeSession(dbUser, options);
                 return true;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ideal-auth",
-  "version": "1.3.1",
+  "version": "1.3.3",
   "description": "Auth primitives for the JS ecosystem. Zero framework dependencies.",
   "scripts": {
     "build": "tsc",