The refusal said the same thing. It did not take the same time!
Unknown address and wrong password returned an identical message — and very different response times, because short-circuiting skipped the hash.
Read →#security
2 posts.
Archive
The JWT claim that lost a fraction of a second and it kills all auth
A password change should end older sessions. It sometimes ended the new one too, because PyJWT truncates a datetime claim to whole seconds. And you can never claim your own JWT!
All 2 posts
Spotted a mistake in one of these, or working on the same thing? Write to me.