Rob Winch c076f0f2e1 SEC-2056: DaoAuthenticationProvider performs isPasswordValid when user not found ...

Previously authenticating a user could take significantly longer than
determining that a user does not exist. This was due to the fact that only
users that were found would use the password encoder and comparing a
password can take a significant amount of time. The difference in the
time required could allow a side channel attack that reveals if a user
exists.

The code has been updated to do comparison against a dummy password
even when the the user was not found.

2012-10-07 12:14:08 -05:00

..

src

SEC-2056: DaoAuthenticationProvider performs isPasswordValid when user not found

2012-10-07 12:14:08 -05:00

core.gradle

SEC-1906: Update to Gradle 1.0

2012-07-05 12:41:56 -05:00

template.mf

SEC-1743: Separate remoting from core into separate module.

2011-05-16 00:19:30 +01:00