Function: verifyDummyPassword()

verifyDummyPassword(password, userUid?, config?): Promise<void>

Defined in: auth/src/auth/shared.ts:1036

Performs an Argon2 verification against a fixed dummy hash, discarding the result. Used to equalize the response time of a "user not found" path with a "user found, password checked" path so that an attacker can't enumerate valid usernames/emails by measuring response latency (a nonexistent user would otherwise short-circuit before ever running the deliberately-slow Argon2 verify).

When userUid/config are supplied (every password call site — see BaseAuthBasicRoute/ BaseAuthElevationRoute), password is first run through normalizePasswordSubmission() exactly as a real verification would, so this dummy path costs the same as a real attempt of the same submitted shape (plaintext vs. already client-hashed vs. a below-floor fake hash) — otherwise the extra hash step that branch adds would itself become a timing side-channel. Omit them (as the recovery-code call site does) to fall back to the original, single-verify-only behavior, which has no such branch to equalize.

Parameters

password

string

The value to verify against the dummy hash. Never actually a real password of anyone.

userUid?

string

The account uid a real attempt would have normalized against. Never a real account.

config?

PasswordConfig

Supplies the minimum accepted client-hash cost parameters.

Returns

Promise<void>