Rob Winch c076f0f2e1 SEC-2056: DaoAuthenticationProvider performs isPasswordValid when user not found ... Previously authenticating a user could take significantly longer than determining that a user does not exist. This was due to the fact that only users that were found would use the password encoder and comparing a password can take a significant amount of time. The difference in the time required could allow a side channel attack that reveals if a user exists. The code has been updated to do comparison against a dummy password even when the the user was not found.		2012-10-07 12:14:08 -05:00
..
src	SEC-2056: DaoAuthenticationProvider performs isPasswordValid when user not found	2012-10-07 12:14:08 -05:00
core.gradle	SEC-1906: Update to Gradle 1.0	2012-07-05 12:41:56 -05:00
template.mf	SEC-1743: Separate remoting from core into separate module.	2011-05-16 00:19:30 +01:00